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The October 2001 anthrax attacks, 
the recent outbreak of the virulent 
Severe Acute Respiratory 
Syndrome (SARS), and increased 
awareness that terrorist groups 
may be capable of releasing life- 
threatening biological agents have 
prompted efforts to improve our 
nation's preparedness for, and 
response to, public health 
emergencies — including 
bioterrorism. GAO was asked, 
among other things, to identify 
federal agencies' information 
technology (IT) initiatives to 
support our nation's readiness to 
deal with bioterrorism. 
Specifically, we compiled an 
inventory of such activities, 
determined the range of these 
coordination activities with other 
agencies, and identified the use of 
health care standards in these 
efforts. 
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In order to enhance American 
preparedness for public health 
emergencies — especially those 
involving bioterrorism — GAO 
recommends that the Secretary of 
Health and Human Services (HHS), 
in coordination with other key 
stakeholders, develop a strategy 
that includes setting priorities for 
IT initiatives and coordinating the 
development of IT standards for 
the health care industry. 
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report, agencies concurred with 
our results but did not comment on 
the recommendations. Technical 
comments were incorporated as 
appropriate. 
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What GAO Found 

The six key federal agencies involved in bioterrorism preparedness and 
response identified about 70 planned and operational information systems in 
several IT categories associated with supporting a public health emergency. 
These encompass detection (systems that collect and identify potential 
biological agents from environmental samples), surveillance (systems that 
facilitate ongoing data collection, analysis, and interpretation of disease- 
related data), communications (systems that facilitate the secure and timely 
delivery of information to the relevant responders and decision makers), and 
supporting technologies (tools or systems that provide information for the 
other categories of systems) — see table below. For example, the Centers for 
Disease Control and Prevention (CDC) is currently implementing its Health 
Alert Network, an early warning and response system intended to provide 
federal, state, and local agencies with better communications during public 
health emergencies, and the Department of Defense is using its Electronic 
Surveillance System for the Early Notification of Community-based 
Epidemics to support early identification of infectious disease outbreaks in 
the military by comparing analyses of data collected daily with historical 
trends. The extent of coordination or interaction of these systems among 
agencies covered a wide range — from an absence of coordination, to 
awareness among the agencies with no formal coordination, to formal 
coordination, to joint development of initiatives. 

Summary of the Systems Inventory by Agency 
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Total 


28 
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72 



Source: GAO. 

IT can more effectively facilitate emergency response if standards are 
developed and implemented that allow systems to be interoperable. The 
need for common, agreed-upon standards is widely acknowledged in the 
health community, and activities to strengthen and increase the use of 
applicable standards are ongoing. For example, CDC has defined a public 
health information architecture, which identifies data, communication, and 
security standards needed to ensure the interoperability of related systems. 
Despite these ongoing efforts to address IT standards, many issues remain to 
be worked out, including coordinating the various standards-setting 
initiatives and monitoring the implementation of standards for health care 
delivery and public health. An underlying challenge for establishing and 
implementing such standards is the lack of an overall strategy guiding IT 
development and initiatives. Without such a strategy to address the 
development and implementation of standards, agencies may not be well 
positioned to take advantage of IT that could facilitate better preparation for 
and response to public health emergencies — including bioterrorism. 
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May 30, 2003 



Congressional Requesters: 

The October 2001 anthrax attacks highlighted long-standing weaknesses in 
the current public health infrastructure 1 and prompted efforts to improve 
our nation's preparedness for and response to public health emergencies, 
including bioterrorism. 2 More recent events have further heightened 
awareness of and anxiety related to the consequences of potential 
bioterrorism or other public health emergencies. For example, on March 
15, 2003, the World Health Organization issued an emergency travel 
advisory due to an unknown form of pneumonia now known as Severe 
Acute Respiratory Syndrome (SARS). Originating in China, it has infected 
over 7,900 people and caused at least 662 deaths worldwide — with 67 
probable cases reported in the United States as of May 20, 2003. Further, 
terrorist organizations, such as al Qaeda, may be capable of releasing life- 
threatening biological agents through covert or overt attacks. These events 
and possibilities illustrate not only the increased chances that harmful 
biological agents could be intentionally released into the environment, but 
also the rapid and widespread effects of naturally occurring infectious 
diseases. 

Many of the activities under way to prepare for and respond to public 
health emergencies — including bioterrorism — are supported by 
information technology (IT), which can better enable public health 
agencies to identify naturally occurring or intentionally caused disease 
outbreaks and can support communications related to public health. 
Recent events, such as those mentioned, have led to increased action and 
funding for undertakings related to bioterrorism throughout the federal 
government. In these undertakings, it is important that the IT 



lr The public health infrastructure is the foundation that supports the planning, delivery, and 
evaluation of public health activities and is comprised of a well-trained workforce, effective 
program and policy evaluation, sufficient epidemiology and surveillance capability to 
detect outbreaks and monitor incidence of diseases, appropriate response capacity for 
public health emergencies, effective laboratories, secure information systems, and 
advanced communications systems. 

2 Bioterrorism is the threat or intentional release of biological agents (viruses, bacteria, or 
their toxins) for the purpose of influencing the conduct of government, or intimidating or 
coercing a civilian population. 
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responsibilities and activities of federal public health entities be well 
planned and coordinated to effectively address the response to 
bioterrorism, reducing the risk of duplicating efforts and creating 
incompatible systems. 

You asked us to review federal agencies' IT efforts to support bioterrorism 
preparedness and response. Specifically, our objectives were to 

• compile an inventory of federal agencies' current and planned IT 
systems and initiatives related to bioterrorism, and to identify the range 
of coordination activities; 

• identify and describe the development and use of health care IT 
standards for bioterrorism-related systems; and 

• review the potential use of emerging information technologies to 
support bioterrorism preparedness and response. 

We focused our review on six key federal agencies that are responsible for 
supporting the response to bioterrorism and other public health 
emergencies using IT: the Department of Agriculture (USDA), the 
Department of Defense (DOD), the Department of Energy (DOE), the 
Department of Health and Human Services (HHS), the Department of 
Veterans Affairs (VA), and the Environmental Protection Agency (EPA). 
Further details about our objectives, scope, and methodology are provided 
in appendix I. 

We performed our work at USDA, DOD, HHS, VA, and EPA offices in 
Washington, DC; the Centers for Disease Control and Prevention (CDC) in 
Atlanta, GA; DeKalb County Board of Health in Decatur, GA; Lawrence 
Livermore and Sandia National Laboratories in Livermore, CA; Sandia 
National Laboratory in Albuquerque, NM; Los Alamos National Laboratory 
in Los Alamos, NM; Denver County Department of Health in Denver, CO; 
and Monroe County Department of Health in Rochester, NY, from June 
2002 through March 2003, in accordance with generally accepted 
government auditing standards. 
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Results in BllGf ^ e S ^ ^ e( ^ era ^ a S enc i es involved in bioterrorism preparedness and 

response have a large number of existing and planned bioterrorism-related 
information systems. Specifically, these agencies identified 72 information 
systems and supporting technologies, as well as 12 other IT initiatives. Of 
the 72 systems, 34 are surveillance systems, 18 are supporting 
technologies, 10 are communications systems, and 10 are detection 
systems. 3 For example, CDC is currently implementing its Health Alert 
Network, an early warning and response system intended to provide 
federal, state, and local agencies with better communications during 
public health emergencies. DOD is using its Electronic Surveillance 
System for the Early Notification of Community-based Epidemics to 
support early identification of infectious disease outbreaks in the military 
by comparing analyses of data collected daily with historical trends. In 
planning or operating each of these information systems and IT initiatives, 
the extent of coordination or interaction between the lead agency and 
other related government agencies covered a wide range. Such 
coordination ranged from an absence of contact with other agencies, to 
awareness among the agencies, to formal coordination, to joint 
development of initiatives. For example, about 30 percent of the systems 
and initiatives are formally coordinated or jointly developed with other 
agencies. 

The identification and implementation of health care data, 
communications, and security standards — which are necessary to support 
the compatibility and interoperability of agencies' various IT systems — 
remain incomplete across the health care sector. However, efforts in the 
federal government are under way to strengthen and increase the use of 
applicable standards throughout the nation's health information 
infrastructure. For example, CDC has defined a public health information 
architecture, which identifies public health data, communications, and 
security standards that are needed to ensure the interoperability of related 
systems. At the same time, this architecture is still evolving, and many 
issues — such as coordination of the various efforts to ensure consensus on 
standards, establishment of milestones, and implementation 



3 Surveillance systems facilitate the performance of ongoing collection, analysis, and 
interpretation of disease-related data. Supporting technologies are tools or systems that 
provide information for the other categories of systems. Communications systems 
facilitate the secure and timely delivery of information to the relevant responders and 
decision makers. Detection systems consist of devices for the collection and identification 
of potential biological agents from environmental samples that include an IT component 
that facilitates the collection of data for surveillance. 
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mechanisms — remain to be worked out. Consequently, federal agencies 
and others associated with the public health infrastructure cannot ensure 
their systems' abilities to exchange data with other systems when needed 
and cannot ensure effective preparation for and response to bioterrorism 
and other public health emergencies. For example, according to CDC 
officials, one of the IT challenges encountered by public health officials 
responding to the anthrax events of October 2001 was the issue of 
exchanging data between the many participants involved in the 
response — clinical sites, local health departments, emergency responders, 
state health departments, public health laboratories, and federal agencies. 
During this event, participants accumulated dissimilar data and principally 
exchanged it manually. An underlying challenge for establishing and 
implementing standards is that no overall strategy guides IT development 
and initiatives. 

The use of emerging information technologies to support the public health 
infrastructure could help to improve federal agencies' abilities to prepare 
for and respond to public health emergencies. Agencies have taken steps 
to adopt such emerging technologies. For example, Los Alamos National 
Laboratory is working on a Web-based system called the Forensics 
Internet Research Exchange, which supports the sharing of biothreat 
information among research and government agencies and uses public 
networks to securely transport private intra-agency and interagency 
information. However, barriers exist, such as the lack of a mechanism for 
identifying and prioritizing appropriate emerging information technologies 
for their transition into the public health community. 

We are making recommendations to the Secretary of Health and Human 
Services, in coordination with other key stakeholders, to develop a 
strategy for public health preparedness and response that includes setting 
priorities for IT initiatives and coordinating the development of IT 
standards for the health care industry. 

We received written comments on a draft of this report from the Deputy 
Assistant Secretary of Defense for Chemical/Biological Defense at DOD, 
the Acting Associate Administrator for Management and Administration at 
DOE, the Acting Principal Deputy Inspector General at HHS, and the 
Secretary of Veterans Affairs. These four agencies generally concurred 
with our results but did not comment specifically on the 
recommendations. Technical comments were incorporated in this report 
as appropriate. USDA and EPA officials provided oral comments, which 
were also technical in nature and have been incorporated as appropriate. 
While DHS was not included as one of the agencies in our review because 
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it did not exist until the end of this engagement, we provided DHS officials 
with the opportunity to comment on the draft of this report, which they 
declined. In their comments, HHS officials stated that the focus of this 
report on IT overemphasized its role and does not address other 
components of the public health infrastructure and may simplify a 
complex issue. As we describe in the background section of this report, IT 
is a tool that enables personnel to fulfill their mission. We recognize that 
there are other important issues about the public health infrastructure that 
merit attention, such as workforce capacity and training, capacity of the 
public health laboratories, and variation in state public health laws, among 
others. 



Background Harmful biological agents can be released by way of the air, food, water, 

° or insects. Their release may not be recognized for several days, during 

which time a communicable disease — such as smallpox — can spread to 
others who were not initially exposed. Some biological agents — such as 
anthrax and plague — produce symptoms that can easily be confused with 
influenza or other, less virulent illnesses, leading to a delay in diagnosis or 
identification. For example, the recent outbreak of the new infectious 
disease, SARS, whose onset includes common symptoms such as high 
fever, coughing, and difficulty in breathing, was not recognized until about 
4 months after the first known case. 



Initial response to a public health emergency, including an act of 
bioterrorism, is generally a local responsibility that could involve multiple 
jurisdictions in a region, with states providing additional support when 
needed. Since clinicians at the local level are most likely to be the first 
ones to detect an incident, they and local public health officials are 
expected to report incidents or symptoms of suspicious illness to the state 
health department and other designated parties. States can provide 
supporting personnel, financial resources, laboratory capacity, and other 
assistance to local responders. Because of the many participants involved, 
the identification and management of bioterrorism and other public health 
emergencies call for effective communication and collaboration across all 
levels of government and the private sector. Figure 1 presents the probable 
series of responses to the release of a biological agent by the various 
players. 4 



4 U.S. General Accounting Office, Bioterrorism: Preparedness Varied Across State and 
Local Jurisdictions, GAO-03-373 (Washington, D.C.: April 7, 2003). 
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Figure 1 : Local, State, and Federal Agencies Involved in Response to the Release of a Biological Agent 




Local level 
(Private and public) 
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State level 




Federal level" 



Department of Health and Human Services 

Office of the Assistant Secretary 

for Public Health Emergency Preparedness 

- Coordination of response 

- HHS Command Center 

Food and Drug Administration 

- Food safety surveillance 

Centers for Disease Control and Prevention 

- Disease and outbreak surveillance 

- Testing and advice 

- Communications and alerts 

- Emergency Operations Center 



Other federal agencies 

Department of Defense 

- Detection of biological agents 

- Disease and outbreak surveillance 

Department of Energy 

- Detection of biological agents 

- Disease and outbreak surveillance 

- Simulation and modeling tools 

U.S. Department of Agriculture 

- Domestic and imported food safety surveillance 

- Communications regarding animal disease outbreaks 
and contamination 

Environmental Protection Agency 

- Drinking water safety monitoring 

Veterans Affairs 

Disease and pathogen surveillance 



"Health care providers can also contact state entities directly. 

"Federal departments and agencies can also respond directly to local and state entities. 

The Strategic National Stockpile, formerly the National Pharmaceutical Stockpile, is a repository of 
pharmaceuticals, antidotes, and medical supplies that can be delivered to the site of a biological (or 
other) attack. 
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Prior to the anthrax incidents in October 2001, a number of threats and 
hoaxes involving biological agents, and at least one successful bioterrorist 
act, had occurred domestically. 5 Since that time, health care and public 
health officials at the federal, state, tribal, local, and international levels, as 
well as the private sector — part of a complex network of people, systems, 
and organizations — have examined their readiness to respond to acts of 
bioterrorism and have found weaknesses. Among others, these 
weaknesses include (1) vulnerable and outdated health information 
systems and technologies, (2) lack of real-time surveillance and 
epidemiological systems, (3) ineffective and fragmented communications 
networks, (4) incomplete domestic preparedness and emergency response 
capability, and (5) communities without access to essential public health 
services. 6 These reported deficiencies at local, state, and federal levels may 
hinder the effective detection and identification of a potentially harmful 
biological agent. 

The broad scope of bioterrorism activities brings together different 
professional communities with very diverse areas of expertise — the public 
health and medical community, the scientific community, and the 
intelligence and law enforcement community. The public health and 
medical community — consisting of public health officials, clinicians, 
traditional first responders, and veterinary and agricultural communities — 
is responsible for protecting the health of people, animals, and agricultural 
products. The scientific community — consisting of human, microbial, 
animal, plant, and environmental researchers, among others — 
characterizes, develops detection systems for, and creates vaccines and 
treatments for diseases caused by biological agents. The intelligence and 
law enforcement community — consisting of intelligence analysts, law 
enforcement officers, diplomatic officials, and military officers — monitor 
and deter terrorist movement and activity. 7 In addition, other professions, 
such as drug store pharmacists and school administrators, are being 
identified as new players in bioterrorism preparedness and response. 



D In 1984 a group intentionally contaminated salad bars in local restaurants in Oregon with 
salmonella bacteria to prevent people from voting in a local election. 

"institute of Medicine of the National Academies, The Future of the Public's Health in the 
21st Century (Washington, D.C.: November 11, 2002). 

'RAND Science and Technology Policy Institute, Summit on Information Technology 
Infrastructure for Bioterrorism (Arlington, VA). 
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Public health and private laboratories are another vital part of the 
surveillance network because only laboratory results can definitively 
identify pathogens. 8 Every state has at least one public health laboratory to 
support its disease surveillance activities and other public health 
programs. State laboratories conduct testing for routine surveillance or as 
part of special clinical or epidemiological studies. Independent 
commercial and hospital laboratories may also share with public health 
agencies information they have gathered through their private surveillance 
efforts, such as studies of patterns of antibiotic resistance or of the spread 
of diseases within a hospital. In addition, commercial and hospital 
laboratories may be required by state law or regulation to report certain 
findings for public health surveillance. 

Federal agencies have key responsibilities for bioterrorism preparedness 
and response. HHS has primary responsibility for coordinating the nation's 
response to public health emergencies, including bioterrorism. HHS 
divisions responsible for bioterrorism preparedness and response, and 
their primary responsibilities include: 

• The Office of the Assistant Secretary for Public Health Emergency 
Preparedness coordinates the department's work to oversee and 
protect public health, including cooperative agreements with states and 
local governments. States and local governments can apply for funding 
to upgrade public health infrastructure and health care systems to 
better prepare for and respond to bioterrorism and other public health 
emergencies. On May 9, 2003, HHS announced that guidelines have 
been released for the use of $1.4 billion allocated for bioterrorism 
cooperative agreements. It maintains a recently built command center, 
where it can coordinate the response to public health emergencies 
from one centralized location. This center is equipped with satellite 
teleconferencing capacity, broadband Internet hookups, and analysis 
and tracking software. 

• CDC has primary responsibility for nationwide disease surveillance for 
specific biological agents, and it also provides an array of scientific and 
financial support for state infectious disease surveillance, prevention, 
and control. For example, CDC administers cooperative agreements for 
public health preparedness totaling $870 million for fiscal year 2003. 
CDC has been addressing bioterrorism preparedness and response 



Pathogens are bacteria, viruses, parasites, or fungi that have the capability to cause 
disease in humans. 
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explicitly since 1998. In April 2003, CDC opened a new emergency 
operations center to organize and manage all emergency operations at 
CDC, allowing for immediate communication between CDC, HHS, DHS, 
as well as federal intelligence and emergency response officials, and 
state and local public health officials. CDC also provides testing 
services and consultation that are not available at the state level; 
training on infectious diseases and laboratory topics, such as testing 
methods and outbreak investigations; and grants to help states conduct 
disease surveillance. In addition, CDC provides state and local health 
departments with a wide range of technical, financial, and staff 
resources to help maintain or improve their ability to detect and 
respond to disease threats. 

CDC laboratories provide highly specialized tests that are not always 
available in state public health or commercial laboratories, and they 
assist states with testing during outbreaks. These laboratories help 
diagnose life-threatening, unusual, or exotic infectious diseases, 
including those that may be caused by bioterrorist attacks, such as 
smallpox. CDC also conducts research to develop improved diagnostic 
methods, and it trains laboratory staff to use them. 

• The Agency for Healthcare Research and Quality (AHRQ) is 
responsible for supporting research designed to improve the outcomes 
and quality of health care, reduce its costs, address safety and medical 
errors, and broaden access to effective services, including anti- 
bioterrorism research. AHRQ has initiated several major projects and 
activities designed to assess and enhance the linkages between the 
clinical care delivery system and the public health infrastructure. 
AHRQ-supported research focuses on emergency preparedness of 
hospitals and health care systems for bioterrorism and other public 
health events; technologies and methods to improve the linkages 
between the personal health care system, emergency response 
networks, and public health agencies; and training and information 
needed to prepare clinicians to recognize the symptoms of bioterrorist 
agents and manage patients appropriately. 

• The Food and Drug Administration (FDA) is responsible for 
safeguarding the food supply, ensuring that new vaccines and drugs are 
safe and effective, and conducting research on diagnostic tools and 
treatment of disease outbreaks. It is increasing its food safety 
responsibilities by improving its laboratory preparedness and food 
monitoring inspections in accordance with the Public Health Security 
and Bioterrorism Preparedness and Response Act of 2002. 
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• The National Institutes of Health (NIH) is responsible for conducting 
medical research in its own laboratories and for supporting the 
research of nonfederal scientists in universities, medical schools, 
hospitals, and research institutions throughout the United States and 
abroad. Its National Institute of Allergy and Infectious Diseases has a 
program to support research related to organisms that are likely to be 
used as biological weapons. NIH is planning to implement a strategic 
plan for research on CDC's category A, B, and C biological agents. 9 A 
complete list of these agents is included in appendix II. 

• The Health Resources Services Administration (HRSA) is responsible 
for improving the nation's health by ensuring equal access to 
comprehensive, culturally competent, quality health care. Its 
Bioterrorism Hospital Preparedness program administers cooperative 
agreements, totaling $498 million, to state and local governments to 
support hospitals' efforts toward bioterrorism preparedness and 
response. 

Besides HHS, other federal departments and agencies are involved in 
bioterrorism preparedness and response efforts, including the following: 

• DOD, while primarily responsible for the health and protection of its 
service members on the battlefield, conducts research on bioterrorism 
preparedness and response through agencies such as the Defense 
Advanced Research Projects Agency. This research supports force 
protection and is shared with other agencies when it may benefit the 
civilian population. It also has civil support responsibilities through the 
Joint Task Force for Civil Support, the National Guard, and the Army. 

• DOE's national laboratories are developing new capabilities for 
countering chemical and biological threats, including biological 
detection, modeling, and prediction. 

• EPA is responsible for protecting the nation's water supply from 
terrorist attack. In January 2003, it established a new homeland 



Category A agents include organisms that pose a risk to national security because they can 
be easily disseminated or transmitted from person to person; result in high mortality rates 
and have the potential for major public health impact; and require special action for public 
health preparedness. Category B agents include those that are moderately easy to 
disseminate and result in moderate morbidity rates and low mortality rates. Category C 
agents include emerging pathogens that could be engineered for mass dissemination in the 
future because of availability, ease of production and dissemination, and potential for high 
morbidity and mortality rates and major health impact. 
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security research center. The center is assessing threat management 
for the water supply and environmental detectors for potential use in 
protecting the water supply. 

• USDA has become involved in bioterrorism preparedness and response 
because of the increasing realization that the food supply may become 
a vehicle for a biological attack. Biological attacks on the health of 
animals and plants are important because animals and plants can 
spread diseases and toxins that may be harmful to humans. 

• VA manages one of the nation's largest health care systems and is the 
nation's largest drug purchaser. The department purchases 
pharmaceuticals and medical supplies for the Strategic National 
Stockpile and the National Medical Response Team stockpile. The 
Department of Veterans Affairs Emergency Preparedness Act of 2002 10 
recently directed VA to establish at least four medical emergency 
preparedness centers to (1) carry out research and develop methods of 
detection, diagnosis, prevention, and treatment for biological and other 
public health and safety threats; (2) provide education, training, and 
advice to health care professionals inside and outside VA; and (3) 
provide laboratory and other assistance to local health care authorities 
in the event of a national emergency. At least one of VA's new centers 
is to focus on biological threats. 

On June 12, 2002, Congress passed the Public Health Security and 
Bioterrorism Preparedness and Response Act of 2002. 11 The legislation 
requires specific activities related to bioterrorism preparedness and 
response. For example, it calls for steps to improve the nation's 
preparedness for bioterrorism and other public health emergencies by 
increasing coordination and planning for such events; developing priority 
countermeasures, such as the Strategic National Stockpile; and improving 
state, local, and hospital preparedness for and response to bioterrorism 
and other public health emergencies. It also requires HHS and USDA to 
enhance controls on dangerous biological agents and toxins to protect the 
safety of food, drugs, and drinking water. 

On November 25, 2002, Congress enacted legislation creating the new 
Department of Homeland Security (DHS). 12 Consolidating the functions of 



Public Law 107-287 (November 7, 2002). 
Public Law 107-188 (June 12, 2002). 
! Public Law 107-296 (November 25, 2002). 
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22 federal agencies, DHS's primary missions include (1) preventing 
terrorist attacks in the United States, (2) reducing America's vulnerability 
to terrorism, and (3) minimizing the damage from potential attacks and 
natural disasters. DHS was established on January 24, 2003; most of the 
agencies were transferred effective March 1, 2003. According to DHS, the 
Secretary has until January 2004 to bring all 22 agencies into the new 
organization. 

The new department is responsible for assisting all levels of government in 
meeting their responsibilities in domestic emergencies and other 
challenges — especially in dealing with incidents that are chemical or 
biological in nature — through planning, mitigation, preparedness, 
response, and recovery activities. DHS is to develop and deploy 
countermeasures to current and emerging terrorist threats. In conjunction 
with HHS, it is to coordinate the nation's preparedness and response to 
bioterrorism. Two of DHS's five divisions are to address preparedness and 
response to bioterrorism. The Emergency Preparedness and Response 
Division's mission includes assisting all levels of government, and others, 
in responding to domestic emergencies; the Science and Technology 
program's mission includes developing and deploying countermeasures to 
current and emerging terrorist threats, including bioterrorism. For fiscal 
year 2004, the President's budget requested $365 million to develop and 
implement integrated systems to reduce the probability and consequences 
of a biological attack on the nation's civilian population and agricultural 
system. DHS has inherited programs from other departments that have a 
bioterrorism role, such as USDA's Agricultural Research Service and 
Animal and Plant Health Inspection Service. 

We have designated the implementation and transformation of DHS as 
high risk and have added it to our 2003 high risk list. This designation is 
based on three factors. First, the implementation and transformation of 
DHS is an enormous undertaking that will take time to achieve in an 
effective and efficient manner. Second, DHS's prospective components 
already face a wide array of existing management and operational 
challenges. Finally, failure to effectively carry out DHS's mission would 
expose the nation to potentially very serious consequences. 13 



U.S. General Accounting Office, Major Management Challenges and Program Risks: 
Department of Homeland Security, GAO-03-102 (Washington, D.C.: January 1, 2003). 
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Role of Information 
Technology for 
Bioterrorism Preparedness 
and Response 



IT can play an essential role in supporting federal, state, local, and tribal 
governments in bioterrorism readiness efforts. Development of IT builds 
upon the existing systems capabilities of local and state public health 
agencies, not only to provide routine public health functions but also to 
support public health emergencies, including bioterrorism. For public 
health emergencies in particular, the ability to quickly exchange data from 
provider to public health agency — or from provider to provider — is crucial 
in detecting and responding to naturally occurring or intentional disease 
outbreaks. It allows physicians to share individually identifiable 
information with public health agencies for use in performing public 
health activities. 



In March 2001, CDC's Public Health's Infrastructure: A Status Report 
acknowledged several IT limitations in the public health infrastructure. 
For example, basic capability for disease surveillance systems to detect 
and analyze disease outbreaks is lacking for several reasons. First, health 
care providers have traditionally used paper- or telephone-based systems 
to report disease outbreaks to approximately 3,000 public health agencies. 
This is a labor-intensive, burdensome process for local health care 
providers and public health officials, often resulting in incomplete and 
untimely data. Second, not all public health agencies have access to the 
Internet or to secure channels for electronically transmitting sensitive 
data. 



Several categories of IT can play vital roles during the course of an event. 
These categories are described in a technology assessment for AHRQ that 
was completed by the University of California San Francisco-Stanford 
Evidence-based Practice Center. 14 These categories of IT serve different 
but related functions and include the following: 

• Detection — systems that consist of devices for the collection and 
identification of potential biological agents from environmental 
samples, which make use of IT to record and send data to a network. 

• Surveillance — systems that facilitate the performance of ongoing 
collection, analysis, and interpretation of disease-related data to plan, 
implement, and evaluate public health actions. 



"University of California San Francisco-Stanford Evidence-based Practice Center, 
Bioterrorism Preparedness and Response: Use of Information Technologies and Decision 
Support Systems (Stanford, CA: June 2002). A copy of the report can be downloaded at 
www.ahrq.gov/clinic/evrptfiles.htm#bio-it. 
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• Diagnostic and clinical management — systems with potential utility 
for enhancing the likelihood that clinicians will consider the possibility 
of bioterrorism-related illness. These systems are generally designed to 
assist clinicians in developing a differential diagnosis for a patient who 
has an unusual clinical presentation. 

• Communications — systems that facilitate the secure and timely 
delivery of information to the relevant responders and decision makers 
so that appropriate action can be taken. 

• Supporting technologies — tools or systems that provide information 
for the other categories of systems (e.g., detection, surveillance, etc.). 15 

Recognizing the importance of IT to strengthening the public health 
infrastructure, RAND's Science and Technology Policy Institute held a 
series of workshops between November 2001 and April 2002. The 
workshops brought together a diverse set of stakeholders to begin the 
process of developing an IT infrastructure that could support bioterrorism 
preparedness efforts across the country. 16 During these workshops, 
consensus was reached on the need for an overarching IT infrastructure to 
prepare for and respond to bioterrorism and other public health 
emergencies. RAND described the different phases of a bioterrorism event 
and the intensity of need for IT during each phase, and it proposed that a 
bioterrorism event could consist of the following phases: 

• Prevention and preparedness — includes reducing the possibility of a 
biological event by methods such as developing vaccines, conducting 
desktop exercises, and heightening alert status. 

• Event recognition — includes monitoring and detecting the release of 
a biological agent or identifying the first case of an illness, by methods 
such as using detection devices and surveillance systems and 
diagnosing the first case of smallpox. 

• Early and sustained response — includes initiating the response to 
the initial event and then continuing the measures required to address 
the longer-term impact of the exposure, such as deploying resources to 



""Categorized to take into consideration research and development projects that may offer 
promising techniques; not part of UCSF-Stanford Technology Assessment. 

16 RAND Science and Technology Policy Institute, Summit on Information Technology 
Infrastructure for Bioterrorism (Arlington, VA). 
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contain a biological agent, identifying the source, replenishing medical 
supplies, ensuring surge capacity for the treatment of victims, and 
monitoring exposed individuals. 

• Recovery — includes recovering after the biological threat is under 
control, by measures such as providing mental health support, 
restocking vaccine and drug reserves, and identifying lessons learned 
to improve future responses. 

According to RAND, during the course of a bioterrorism event, IT should 
be capable of addressing all phases of the event. Because of the dynamic 
and unpredictable nature of public health emergencies, various types of IT 
are needed during the course of an event. These systems and the intensity 
of their need for IT may vary from event to event, depending on the 
circumstances. In addition, IT components that are required for one phase 
may also be critical for other phases, but the intensity of need for them 
may vary. These needs include consideration of the phase being 
supported, required capabilities for each phase, and the data required at 
various points in time. Figure 2 illustrates the probable intensity of need 
for each category of IT across the different phases. 
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Figure 2: IT Needs during a Public Health Emergency 




Source: RAND, UCSF-Stanford. 



About 70 

Bioterrorism-Related 
Information 
Technology Activities 
Identified at Six 
Federal Agencies 



The six key federal agencies involved in trie-terrorism preparedness and 
response have a large number of existing and planned bioterrorism-related 
information systems. Specifically, these agencies identified 72 information 
systems and supporting technologies, as well as 12 other IT initiatives. Of 
the 72 information systems, 34 are surveillance systems, 18 are supporting 
technologies, 10 are communications systems, and 10 are detection 
systems. Additionally, in planning or operating each of these systems and 
IT initiatives, the extent of coordination or interaction performed by the 
lead agency with other related government agencies covered a wide range 
of activity. Coordination varied by system and IT initiative, ranging from 
absence of coordination, to awareness without coordination, to formal 
coordination, to joint development of initiatives. For example, about 30 
percent of the information systems and IT initiatives are being either 
formally coordinated or jointly developed with another agency. 
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The six federal agencies with key roles in bioterrorism preparedness and 
response identified 72 existing or planned information systems and 
supporting technologies, as well as 12 other IT initiatives. 17 About 74 
percent of these systems and IT initiatives are currently operational. The 
estimated costs reported for these systems exceed $63 million for fiscal 
year 2003. 18 Of the 72 information systems identified, 34 are surveillance 
systems, 18 are supporting technologies, 10 are communications systems, 
and 10 are detection systems. Of the 12 IT initiatives, HHS identified 4, 
DOD and DOE identified 3 each, and USDA identified 2. Table 1 
summarizes the number of systems by agency and IT category. 



Table 1 : Summary of the Systems Inventory by Agency 



IT categories 


HHS 


DOD 


DOE 


USDA 


EPA 


VA 


Total 


Detection 





4 b 


6 











10 


Surveillance 


18 a 


7 


2 a 


6 





1 


34 


Diagnostic and clinical 
management 























Communications 


5 


2 





3 








10 


Supporting technology 


5 


1 


6 


1 


5 





18 


Total 


28 


14 


14 


10 


5 


1 


72 



Source: GAO. 

"Includes integrated surveillance/communications systems. 
"Includes an integrated detection/communication system. 



Agencies identified a variety of information systems and IT initiatives, 
such as the following: 

• HHS's 28 systems are largely in operation and are used for surveillance 
of diseases and illnesses, as well as for communications. As the lead 
federal agency for protecting the health and safety of the public, CDC is 
responsible for most of the systems included in the HHS inventory. For 



Bioteirorism-Related 
Systems and Initiatives 
Identified at Six Federal 
Agencies 



The NEDSS Base System is included in the systems inventory and the NEDSS architecture 
is included as an IT initiative. 

18 We did not validate cost information reported by the agencies. Additionally, cost 
information was not reported for all the systems included in our review. 
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example, CDC is currently implementing the Health Alert Network 
(HAN), an early warning and response system that is intended to 
provide federal, state, and local health agencies with better 
communications during public health emergencies; additional details 
are provided in appendix III. 

• DOD, while primarily responsible for the health of its service members 
on the battlefield, conducts research on bioterrorism preparedness and 
response for force protection and shares that research with other 
agencies when it may benefit the civilian population. Because of the 
broad nature of DOD's responsibilities, it identified 14 systems in all 
categories. One example of a DOD system is the Electronic 
Surveillance System for the Early Notification of Community-based 
Epidemics (ESSENCE), which supports early identification of 
infectious disease outbreaks in the military by comparing analyses of 
data collected daily with historical trends; additional details are 
provided in appendix III. 

• DOE — specifically its national laboratories — has identified 14 research 
and development efforts for technologies to support detection systems, 
among others. An example is the Biological Aerosol Sentry and 
Information System (BASIS), a portable system of networked air- 
sampling units that are capable of detecting airborne biological 
incidents at large gatherings such as political conventions and major 
indoor and outdoor sporting events; additional details are provided in 
appendix III. 

• USDA's Food Safety and Inspection Service is using IT to support 
methods of inspection to better protect the public from foodborne 
illness. 

• EPA has five systems defined as supporting technologies — two that 
could potentially support surveillance activities on the safety of 
drinking water and three modeling and simulation tools that are used 
to simulate the dispersions of contaminants in water and indoor air. 19 

• VA has one information system that was developed for surveillance 
within its health care facilities. 



EPA relies largely on local water authorities to monitor the safety of water supplies and 
report the information to them. 
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Appendix III provides a detailed description of the IT categories and 
additional information on each, while appendixes IV through IX contain 
detailed descriptions of the information systems and supporting 
technologies by agency. Appendix X contains detailed descriptions of the 
IT initiatives. 



Coordination Mixed 
Among the Information 
Systems and Initiatives 
Identified 



In planning or operating each of these information systems and IT 
initiatives, the extent of coordination or interaction among the lead agency 
and other related government agencies covered a wide range. Such 
coordination ranged from a lack of contact with other agencies, to 
awareness, to formal coordination, to joint development of initiatives. 
According to CDC officials, while collaboration has improved, there are 
still organizational difficulties related to combining resources from 
multiple sources to meet common goals. It is typical for staff or 
contractual resources funded through one mechanism to be kept separate 
from those funded through another mechanism. 

Agencies reported that about 30 percent of systems and initiatives are 
being either formally coordinated or jointly developed with another 
agency. Of the six agencies in our review, CDC and DOE's national 
laboratories accounted for the majority of information systems and IT 
initiatives that identified formally coordinated or jointly developed 
initiatives. One example of a jointly developed information system is 
FDA's eLEXNET system. It is a secure Web-based database for sharing 
laboratory data on food safety among FDA, USDA, DOD, state agriculture, 
and state and local health laboratories. FDA also shares data with other 
HHS operating divisions, as well as with Customs (now part of DHS) and 
the Federal Bureau of Investigations (FBI). This joint effort, which is 
currently in the planning stage, could improve these agencies' abilities to 
address foodborne illnesses. In addition, CDC has several IT initiatives in 
coordination with state and local public health agencies. 
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Health Care Sector 
Making Progress on 
Defining Standards, 
but Implementation 
Challenges Remain 
for Effective 
Information Sharing 



To support the compatibility, interoperability, and security of federal 
agencies' many planned and operational IT systems, the identification and 
implementation of data, communications, and security standards for 
health care delivery and public health are essential. Although federal 
efforts are now under way to strengthen and increase the use of these 
standards, the identification and implementation of these standards 
remain incomplete. Several implementation challenges remain, including 
coordination of the various efforts to ensure consensus on standards, and 
establishment of milestones. Until these challenges are addressed, federal 
agencies cannot ensure their systems' abilities to exchange data with other 
systems when needed. A major consequence of not implementing such 
standards is the promulgation of piecemeal systems, which results in 
disparate systems that cannot exchange data. An underlying challenge for 
establishing and implementing standards is that no overall strategy guides 
IT development and initiatives. 



Key Standards for Health IT standards, including data standards, enable the interoperability and 
Care portability of systems within and across organizations. 20 As we have 

reported in the past, many different standards are required to develop 
interoperable health information systems, which reflect the complex 
nature of health care delivery in the United States. 21 

Vocabulary standards, which provide common definitions and codes for 
medical terms and determine how information will be documented for 
diagnoses and procedures, are one type of data standard. Vocabulary 
standards are intended to lead to consistent descriptions of a patient's 
medical condition by all practitioners. The use of common terminology 
helps in the clinical care delivery process, enables consistent data analysis 
from organization to organization, and facilitates transmission of 
information. Without such standards, the terms used to describe the same 
diagnoses and procedures sometimes vary. For example, the condition 
known as hepatitis may also be described as a liver inflammation. The use 



Interoperability is the ability of two or more systems or components to exchange 
information and to use the information that has been exchanged. Portability is the degree 
to which a computer program can be transferred from one hardware configuration or 
software environment to another. 

21 U.S. General Accounting Office, Automated Medical Records: Leadership Needed to 
Expedite Standards Development, GAO/IMTEC-93-17 (Washington, D.C.: April 30, 1993). 
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of different terms to indicate the same condition or treatment complicates 
retrieval and reduces the reliability and consistency of data. 

In addition to vocabulary standards, messaging standards are also 
important because they provide for the uniform and predictable electronic 
exchange of data by establishing the order and sequence of data during 
transmission. Medical messaging standards dictate the segments in a 
specific medical transmission. For example, they might require the first 
segment to include the patient' s name, hospital number, and birth date. A 
series of subsequent segments might transmit the results of a complete 
blood count, one result (e.g., iron content) per segment. Messaging 
standards can be adopted to enable intelligible communication between 
organizations via the Internet or some other communications pathway. 
Without these standards, the interoperability of federal agencies' systems 
may be limited and may limit the exchange of data that are available for 
information sharing. In addition to vocabulary and messaging standards, 
there is also the need for a high degree of security and confidentiality to 
protect medical information from unauthorized disclosure. More detail on 
these and other key standards is provided in appendix XI. 



The need for health care data standards has been recognized for a number 
of years and progress has been made in defining these standards. Yet, 
despite these efforts, the identification and implementation of these 
standards remains incomplete. CDC acknowledged the need for standards 
specific to public health systems, and in 1995 it established the National 
Electronic Disease Surveillance System (NEDSS) initiative to address the 
limitations of current surveillance systems. These limitations included 
(1) the multiplicity of program-specific information systems, (2) 
incomplete and untimely data, (3) the unacceptable burden on health care 
system respondents, (4) the overwhelming volume of data to be managed 
by state and local health departments, and (5) the lack of state-of-the-art 
IT. As part of the NEDSS initiative, CDC, in collaboration with others, 
agreed to encourage the use of data, communications, and security 
standards that are required for building interoperable public health 
systems. CDC expects that the implementation of NEDSS will improve the 
reporting of disease outbreaks from the states by increasing the 
timeliness, accuracy, and completeness of data. According to CDC, once 
fully implemented, these standards are to provide the ability to merge data 
from laboratories with epidemiological data, in addition to providing the 
ability to obtain information on cross-jurisdictional outbreaks. 



Need for Standards Has 
Been Recognized and 
Federal Actions are Under 
Way to Define and 
Implement Them 
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In August 1996, Congress also recognized the need for standards to 
improve the Medicare and Medicaid programs in particular and the 
efficiency and effectiveness of the health care system in general. It passed 
the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 22 
which calls for the industry to control the distribution and exchange of 
health care data and begin to adopt electronic data exchange standards to 
uniformly and securely exchange patient information. According to the 
National Committee on Vital and Health Statistics (NCVHS), 23 significant 
progress has occurred on several HIPAA standards, however, the full 
economic benefits of administrative simplification will be realized only 
when all of the standards are in place. 24 

In July 2000, the NCVHS again reported on the need for standards, this 
time highlighting the need for uniform standards for patient medical 
record information. They found that major impediments to electronic 
exchange of patient medical information were the limited interoperability 
of health information systems; the limited comparability of data 
exchanged among providers; and the need for better data quality, 
accountability, and integrity. 25 In November 2001, NCVHS issued another 
report outlining a strategy, which includes developing and using standards. 
According to NCVHS, the public health infrastructure could be 
strengthened through more rapid identification and implementation of 
existing standards and other new standards. The Institute of Medicine 
(IOM) and others are also reporting on the lack of national standards for 
the coding and classification of clinical and other health care data, and for 
the secure transmission and sharing of such data. 

Complementary to the work of NEDSS on identifying standards for public 
health systems, in 2001 the Office of Management and Budget created the 
Consolidated Health Informatics (CHI) initiative as one of its e- 
government projects to facilitate the adoption of data standards, among 
others, for health care systems within the federal government. The CHI 



22 Public Law 104-191 (August 21, 1996). 

23 A public advisory committee statutorily authorized to advise the Secretary of HHS on 
national health information policy. 

24 National Committee on Vital and Health Statistics, Fifth Annual Report to Congress on 
the Implementation of the Administrative Simplification Provisions of the Health 
Insurance Portability and Accountability Act (Washington, D.C.: November 12, 2002). 

25 National Committee on Vital and Health Statistics, Report on Uniform Patient Medical 
Records Information (Washington, D.C.: July 6, 2000). 
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initiative is an interagency work group led by HHS and composed of 
representatives from DOD, VA, and other agencies. Recognizing the need 
for standards to be incorporated across federal health care systems, HHS, 
DOD, and VA recently announced its first set of standards (e.g., HL7, 
LOINC) for the electronic exchange of health information to be 
implemented across the federal government. Once federal agencies adopt 
the recommended standards, they are expected to include the standards in 
their architectures and to build systems accordingly. This commitment is 
to apply to all new systems acquisition and development projects. The CHI 
initiative plans to announce additional standards for federal systems as the 
working group agrees upon them, but does not have time frames 
established for making these announcements. 



Several Standards 
Implementation 
Challenges Remain 



Despite progress in defining health care IT standards, several 
implementation challenges — such as coordination of the various initiatives 
to achieve consensus on the use of standards, establishment of milestones, 
and development of implementation mechanisms — remain to be worked 
out. Currently, there are no activities or mechanisms defined to ensure 
coordination and consensus between these initiatives at the national level. 
HHS officials agree that leadership and direction are still needed to 
coordinate the various standards-setting initiatives and to ensure 
consistent implementation of standards for health care delivery and public 
health. Coordination of these initiatives is essential to ensure that the 
completion of standards development is accelerated and that consensus is 
obtained from all stakeholders. According to NCVHS, the process of 
developing health care data standards involves many diverse entities, such 
as individual and group practices, software developers, domain-specific 
professional associations, and allied health services. This fragmentation 
has slowed the dissemination and adoption of standards by making it 
difficult to convene all of the relevant stakeholders and subject matter 
experts in standards development meetings and to reach consensus within 
a reasonable period of time. 



Another challenge is that not all of the federal government's standards- 
setting initiatives have milestones associated with efforts to define and 
implement standards. For example, while the CHI initiative — the primary 
federal initiative to establish standards — has announced such initial 
standards and implementation requirements for health care information 
exchange, it has not yet established milestones for future announcements. 
Accordingly, it is not clear when these announcements will occur. 
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Another challenge is that there is no mechanism to monitor the 
implementation of standards throughout the health care industry. In 
November 2001, NCVHS reported a need for a mechanism, such as 
compliance testing, to ensure that health care standards are uniformly 
adopted as part of a national strategy. NCVHS added that without an 
implementation mechanism and leadership at the national level, problems 
associated with systems' incompatibility and lack of interoperability will 
persist throughout the different levels of government and the private 
sector and, consequently, throughout the health care sector. Since that 
time, however, no national monitoring mechanism has yet been 
established. 

A major consequence of not implementing such standards is the 
promulgation of piecemeal systems, which result in disparate systems that 
cannot exchange data. This leads to information gaps, hindering the 
prompt and accurate identification of emerging biological threats — 
consequently, timely detection of major public health threats is limited. 
For example, according to CDC officials, one of the IT challenges 
encountered by public health officials responding to the anthrax events of 
October 2001 was the issue of exchanging data among the many 
participants involved in the response — clinical sites, local health 
departments, emergency responders, state health departments, public 
health laboratories, and federal agencies. During this event, participants 
accumulated dissimilar data and principally exchanged it manually. 

An underlying challenge for establishing and implementing such standards 
is that no overall strategy guides IT development and initiatives. With no 
overall strategy that addresses the development and implementation of 
standards and associated milestones, federal agencies cannot ensure their 
systems' abilities to exchange data with other systems when needed and 
cannot ensure effective preparation for and response to bioterrorism and 
other public health emergencies. 
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Emerging Information 
Technologies Could 
Enhance Agencies' 
Abilities to Prepare 
for and Respond to 
Public Health 
Emergencies 



Within the public health sector, the implementation of emerging 
information technologies could help to strengthen agencies' technological 
capabilities to support the nation's ability to prepare for and respond to 
bioterrorism and other public health emergencies. Agencies identified 
several activities to research, develop, and implement emerging 
technologies, which were generally initiated to meet agencies' specific 
needs. However, barriers exist that may hinder the public health 
community from benefiting from the implementation of emerging 
information technologies. 



Examples Of Public An emerging technology is one in which research has progressed far 

Health's Use of Emerging enough to indicate a high probability of technical success for new 
Information Technology products and applications that might have substantial markets within 

& approximately 10 years. Agencies identified several IT applications that 

incorporate the use of emerging technologies. They include commercial IT 
and communications solutions, along with IT that was developed 
specifically for the health care sector. Examples of emerging information 
technologies for use in public health applications include the following: 

• Geographic information system (GIS): 26 GIS is being used by 
federal agencies to support disease and outbreak surveillance. CDC 
uses GIS to track the spread of infection through a community, to 
identify geographic areas of particular health concern, and to identify 
susceptible populations. The resulting information can be used in 
support of surveillance systems to help identify spatial clustering of 
abnormal events as the data are collected. GIS was used in 2001 to map 
data related to CDC's emergency response to the anthrax bioterrorism 
event, and it was used in 2002 to aid the FBI's investigation of the 
anthrax attack in Florida. FDA is currently using GIS technology in its 
food safety system, eLEXNET. 

• Web-based images for diagnosis: Several of CDC's systems use the 
Internet to enhance reporting and communications capabilities. For 



GIS is a computer application for capturing, storing, checking, integrating, manipulating, 
analyzing, and displaying data related to positions on the earth's surface. Typically, a GIS is 
used for handling maps of one kind or another. These might be represented as several 
different layers where each layer holds data about a particular kind of feature (e.g., roads). 
Each feature is linked to a position on the graphical image of a map. 
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example, its DPDx system uses the Internet to strengthen the 
capabilities of laboratories to diagnose parasitic diseases. The function 
also enables users to obtain diagnostic assistance over the Internet by 
allowing laboratories to transmit images to CDC and obtain answers to 
inquiries, sometimes within minutes. The system increases the 
interaction between CDC and public health laboratories. 

• Data mining: 27 DOD's ESSENCE system uses data mining technology 
to support early detection of infectious disease outbreaks or 
bioterrorism events. This system enhances public health officials' 
decision-making capabilities regarding events, which may be public 
health emergencies. 

• Grid computing: 28 DOD's Army Medical Research Institute of 
Infectious Diseases is sponsoring a project with the support of several 
partner organizations to use grid-computing techniques to help find a 
treatment for smallpox after infection. The system will run simulated 
tests of molecules representing some 35 million potential drugs to see 
how they interact with the smallpox virus. 

• Computer-aided DNA signature development: DOE's Lawrence 
Livermore National Laboratory is developing software called KPATH, 
which is a computer-aided DNA signature development tool. It analyzes 
pathogen DNA to identify unique signatures. Once identified, these 
signatures can be used to assist in the process of detecting biological 
incidents. The results of such development efforts support an enhanced 
capacity for rapid identification of biological agents. 

• Virtual private network (VPN): DOE's Los Alamos National 
Laboratory is working on an Internet-based system called the Forensics 
Internet Research Exchange, which supports the sharing of biothreat 
information among research and government agencies. This system is 
secured through the use of a VPN. A VPN is a communication system 
that uses public networks to securely transport private 
intraorganizational and interorganizational information. While industry 



Data mining is the extraction of information from databases to discover hidden facts. 
Data mining finds patterns and relationships in data and infers rules that allow the 
prediction of future results. 

28 Grid computing ties together geographically disparate and distributed computers to 
create a single massive computing resource, taking advantage of their processing power. 
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use of VPNs is common, only four of the systems included in our 
inventory use VPNs for public health-specific applications. 

• Public key infrastructure (PKI): CDC has begun using PKI for 
secure communications between public health officials using NEDSS. 
PKI is a system of hardware, software, policies, and people that, when 
fully implemented, can provide a suite of information security 
assurances that are important in protecting sensitive communications 
and transactions. 29 

• Portable biological detection unit: DOE's Sandia National 
Laboratory has made progress toward developing a small sampling and 
analysis instrument that is portable and does not require a chemist's 
expertise to operate. This system, |iChemLab, is the first that reduces 
the size of large instruments to the extent that they can be taken into 
the field and used by first responders, such as firefighters. The device 
utilizes embedded software algorithms that indicate the level of threat 
present in the environment in which the instrument is deployed. 



Barriers to Better Use Of While the public health community may benefit by implementing emerging 
Emerging Technologies information technologies, several factors introduce barriers and risks to 

their successful implementation. One barrier is that emerging technologies 
likely have not been in use long enough for the developers to identify all 
areas for standardization, or for the technologies to have evolved to the 
point that they are interoperable with other already-existing technologies 
within public health. 

Another barrier, according to Gartner, Inc., a leading private research firm, 
is that the use of emerging information technologies may likely change an 
organization's existing business model. Therefore their implementation 
may introduce a significant level of risk. For these reasons, the 
introduction of an emerging information technology may be disruptive to 
existing business processes. 

A third possible barrier is the lack of a clearly defined mechanism for 
continuing research and development for emerging technologies once the 
results are turned over to the public health sector. For example, according 



U.S. General Accounting Office, Information Security: Advances and Remaining 
Challenges to Adoption of Public Key Infrastructure Technology, GAO-01-277 
(Washington, D.C.: February 26, 2001). 
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to a CDC official, there is no mechanism to develop demonstration 
projects to identify and prove the usefulness and applicability of emerging 
technologies within the public health sector at the federal, state, and local 
levels. At the time of our review, funds for two research and development 
efforts that were initially identified as promising were discontinued 
without consideration of the project's value to the public health 
infrastructure. 

Lastly, we observed that activities related to the use of emerging 
technologies are often the result of independent efforts for specific 
purposes. Consequently agencies may not be able to share successes or 
lessons learned. Effectively addressing each of these barriers will be 
essential if the health care industry is to take full advantage of emerging 
information technologies. 



As concerns about the possibility of bioterrorism have been elevated, 
federal, state, and local public health agencies have been increasing efforts 
to prepare for and respond to public health emergencies. Federal agencies 
identified over 70 existing information systems, supporting technologies, 
and IT initiatives that may better support the public health infrastructure. 
The extent of coordination or interaction among the lead agency and other 
related government agencies ranged from a lack of coordination, to 
awareness, to formal coordination, to jointly developed initiatives. As 
these and future systems are pursued, leadership will be essential to set 
priorities for information systems, supporting technologies, and other IT 
initiatives to enhance the effective preparation for and response to 
bioterrorism and other public health emergencies. 

Although a number of efforts are under way, no comprehensive set of 
standards has been implemented sufficiently to fully support the public 
health infrastructure. Leadership and an overall IT strategy are important 
for ensuring that standards development organizations and federal 
agencies address remaining implementation challenges: (1) coordination 
of the various efforts and consensus on the use of standards, 
(2) establishment of milestones for defining and implementing standards, 
and (3) mechanisms for monitoring implementation of standards. Without 
a strategy to ensure coordinated efforts and consistent application of 
standards, federal agencies cannot ensure that their systems are 
compatible or interoperable and, therefore, cannot effectively support 
actions to manage public health emergencies through the timely and 
accurate exchange of information. 
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Finally, federal agencies have begun to implement emerging technologies 
to strengthen the public health infrastructure. While some emerging 
technologies have been implemented, and others are being researched and 
developed, agencies cannot take full advantage of these technologies 
because several barriers exist. Effectively addressing each of these 
barriers will be essential if the health care industry is to fully leverage 
these emerging information technologies. Leadership will be essential to 
address these barriers and also to establish mechanisms for identifying 
and prioritizing uses of emerging technologies to better support the 
nation's ability to prepare for and respond to public health emergencies. 



We recommend that the Secretary of Health and Human Services, in 
coordination with other key stakeholders — such as the Secretaries of 
Defense, Homeland Security, and Veterans Affairs — establish a national IT 
strategy for public health preparedness and response. This IT strategy 
should identify steps toward improving the nation's ability to use IT in 
support of the public health infrastructure. More specifically, it should 

• identify all federal agencies' IT initiatives, using the results of our 
inventory as a starting point; 

• set priorities for information systems, supporting technologies, and 
other IT initiatives; 

• define activities for ensuring that the various standards-setting 
organizations coordinate their efforts and reach further consensus on 
the definition and use of standards; 

• establish milestones for defining and implementing all standards; 

• create a mechanism — consistent with HIPAA requirements — to 
monitor the implementation of standards throughout the health care 
industry; and 

• address existing barriers and establish mechanisms for identifying and 
prioritizing uses of emerging technologies that are appropriate for 
ensuring continued improvements to the nation's ability to prepare for 
and respond to public health emergencies. 



Recommendations 
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Agency Comments 
and Our Evaluation 



We received written comments on a draft of this report from the Deputy 
Assistant Secretary of Defense for Chemical/Biological Defense at DOD, 
Acting Associate Administrator for Management and Administration at 
DOE, the Acting Principal Deputy Inspector General at HHS, and the 
Secretary of Veterans Affairs. These four agencies generally concurred 
with our results, but they did not comment specifically on the 
recommendations. They provided technical comments, which we have 
incorporated in this report as appropriate. USDA and EPA concurred with 
our results in their oral comments, which were primarily technical 
comments and incorporated as appropriate. Technical comments were 
generally limited to additional information or correction of information on 
the description of their systems included in the appendixes. While DHS 
was not included as one of the agencies in our review because they did not 
exist until the end of this engagement, we provided DHS officials with the 
opportunity to comment on the draft of this report, which they declined. 
Written comments from DOD, DOE, HHS, and VA are reproduced in 
appendixes XII to XV. 



Among its comments, HHS officials stated that the focus of this report on 
IT overemphasized its role and does not address other components of the 
public health infrastructure. As we describe in the background section of 
the report, IT is a tool that enables personnel to fulfill their mission. We 
recognize that the United States health care and public health 
infrastructure is a complex network of people, systems, and organizations, 
with participation at all levels — federal, state, tribal, local, international, 
and the private sector. We also recognize that there are other important 
issues about the public health infrastructure that merit attention, such as 
workforce capacity and training, capacity of the public health laboratories, 
variation in state public health laws, capacity of the health care delivery 
systems, and communication strategies for addressing the public. 



As agreed with your offices, unless you publicly announce its contents 
earlier, we plan no further distribution of this report until 30 days from the 
date on the report. At that time, we will send copies of the report to other 
congressional committees. We will also send copies of this report to the 
Secretaries of Agriculture, Defense, Energy, Health and Human Services, 
Homeland Security, and Veterans Affairs, and to the Administrator of the 
Environmental Protection Agency. Copies will also be made available at 
no charge on our Web site at www.gao.gov. 
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If you have any questions on matters discussed in this report, please 
contact me at (202) 512-9286 or M. Yvonne Sanchez, Assistant Director, at 
(202) 512-6274. We can also be reached by E-mail at pownerd@gao.gov and 
sanchezm@gao.gov, respectively. Other contacts and key contributors to 
this report are listed in appendix XVI. 




David A. Powner 

Director (Acting), Information Technology 
Management Issues 
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List of Requesters 
Tom Davis 

Chairman, Committee on Government Reform, 
House of Representatives 

Christopher Shays 

Chairman, Subcommittee on National Security, Emerging Threats, and 

International Relations, 
Committee on Government Reform, 
House of Representatives 

Mary Bono 

Member, House of Representatives 
Jane Harman 

Member, House of Representatives 

Charles Norwood 

Member, House of Representatives 

Charles Pickering 

Member, House of Representatives 

Mac Thornberry 

Member, House of Representatives 
Edolphus Towns 

Member, House of Representatives 
Jim Turner 

Member, House of Representatives 

Edward Whitfield 

Member, House of Representatives 
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Appendix I: Objectives, Scope, and 
Methodology 



The objectives of our review were to 

• compile an inventory of current and planned bioterrorism information 
technology (IT) initiatives at selected federal agencies and identify the 
range of coordination efforts, 

• identify and describe the development and use of health care IT 
standards for bioterrorism-related systems, and 

• review the potential use of emerging information technologies for 
bioterrorism preparedness and response. 

To address these objectives, we conducted our audit work at six selected 
federal agencies — United States Department of Agriculture (USD A), 
Department of Defense (DOD), Department of Energy (DOE), Department 
of Health and Human Services (HHS), Department of Veterans Affairs 
(VA), and the Environmental Protection Agency (EPA) — that we 
previously reported were involved with supporting public health and 
bioterrorism preparedness and response, which included the use of IT. 1 
We excluded federal agencies that are responsible only for law 
enforcement and consequence management related to other types of 
terrorism. 

To compile the inventory of current and planned IT initiatives related to 
bioterrorism, we met with agency officials and identified the categories of 
systems (e.g., detection, surveillance, diagnostic and clinical management, 
communications, and supporting technologies) to be included in the 
inventory and the data to be collected about each system. The inventory 
includes information systems with applications related to both public 
health and bioterrorism, since most systems were developed for routine 
public health purposes but are potentially useful during a bioterrorism 
event. We also created a database for collecting and analyzing the data 
from the selected agencies. Next we collected and compiled the inventory 
data and validated the consistency of the data with each agency. We also 
included systems that were not necessarily designed for public health 
purposes, but might be adapted for that function. We included other 
technologies, such as detection devices that include an IT component that 
facilitates the collection of data for surveillance systems or otherwise 



^.S. General Accounting Office, Bioterrorism: Federal Research and Preparedness 
Activities, GAO-01-915 (Washington, D.C.: September 28, 2001). 



Page 34 



GAO-03-139 Federal Bioterrorism IT 



Appendix I: Objectives, Scope, and 
Methodology 



enable IT to perform diagnosis, management, prevention, surveillance, 
reporting, and communication functions. Our inventory includes 
information systems that support detection, surveillance, diagnostic and 
clinical management, communications, and supporting technologies. 

The inventory specifically excludes the following types of IT: 

• law enforcement and intelligence systems, 

• classified systems, 

• international initiatives, 

• military systems with no applicability to civilian populations (e.g., 
combat-specific systems), 

• distance learning and other training systems, 

• disease-specific surveillance systems with no potential to support 
bioterrorism preparedness and response, 

• systems designed to track agricultural terrorism, and 

• consequence management systems for traditional first responders (e.g., 
police and firefighters). 

We met with and obtained documentation from representatives of several 
nonprofit, research, and public health professional organizations, such as 
the RAND Corporation, the University of California at San Francisco- 
Stanford Evidence-based Practice Center, and the National Association of 
County and City Health Officials. Based on our research and the 
information provided by those parties, we identified categories of IT that 
support public health and bioterrorism preparedness and response. To 
illustrate the role of different categories of IT, we also collected more 
detailed information about selected systems efforts. 

During our discussions with agency officials about the results of their 
inventory data, we asked about an agency's interaction and involvement 
with information systems and IT initiatives being led by other federal 
agencies. We also collected data as part of the systems inventory about 
jointly developed projects that included a partner outside their agency. 
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To identify and describe the development, use, and progress of health care 
data, communications, and security standards, we identified ongoing 
federal efforts and public/private collaborations to implement standards 
for IT systems that could be used to support the public health 
infrastructure. In addition, we met with HHS officials to discuss ongoing 
activities and progress being made to implement the National Committee 
on Vital and Health Statistics' recommendations on the National Health 
Information Infrastructure and other standards-related initiatives. We also 
met with other experts from the Centers for Disease Control and 
Prevention and Stanford University and discussed with them the use and 
applicability of health care standards within the public health 
infrastructure. 

To review the potential use of emerging information technologies for 
bioterrorism preparedness and response, we used research from the 
Department of Commerce and private-sector consultants to define the 
term "emerging technologies" as it pertains to information technology. 
During discussions with agency officials, we asked about their uses and 
experiences with emerging information technologies, as well as barriers to 
their implementation. Then, we reviewed the selected agencies' use of and 
plans for applications specific to public health that were included in the 
systems inventory. 
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Appendix II: CDC Biological Diseases/Agents 
List 



According to CDC, the United States public health system and primary 
health care providers must be prepared to address various biological 
agents, including pathogens that are rarely seen in the United States. CDC 
defines three categories of biological diseases or agents based upon the 
public health impact and the level of risk to the nation's security that the 
transmission of these agents may introduce. The categories and the 
associated agents are described below: 

Category A Diseases/Agents: High-priority agents include organisms 
that pose a risk to national security because they can be easily 
disseminated or transmitted from person to person, result in high 
mortality rates and have the potential for major public health impact, 
might cause public panic and social disruption, and require special action 
for public health preparedness. 

• Anthrax (Bacillus anthracis) 

• Botulism (Clostridium botulinum toxin) 

• Plague (Yersinia pestis) 

• Smallpox (Variola major) 

• Tularemia (Francisella tularensis) 

• Viral hemorrhagic fevers (filoviruses [e.g., Ebola, Marburg] and 
arenaviruses [e.g., Lassa, Machupo]) 

Category B Diseases/Agents: Second highet priority agents include 
those that are moderately easy to disseminate, result in moderate 
morbidity rates and low mortality rates, and require specific 
enhancements of CDC's diagnostic capacity and enhanced disease 
surveillance. 

• Brucellosis (Brucella species) 

• Epsilon toxin of Clostridium perfringens 

• Food safety threats (e.g., Salmonella species, Escherichia coli 0157:H7, 
Shigella) 

• Glanders (Burkholderia mallei) 
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Appendix II: CDC Biological Diseases/Agents 
List 



• Melioidosis (Burkholderia pseudomallei) 

• Psittacosis (Chlamydia psittaci) 

• Q fever (Coxiella burnetii) 

• Ricin toxin from Ricinus communis (castor beans) 

• Staphylococcal enterotoxin B 

• Typhus fever (Rickettsia prowazekii) 

• Viral encephalitis (alphaviruses [e.g., Venezuelan equine encephalitis, 
eastern equine encephalitis, western equine encephalitis]) 

• Water safety threats (e.g., Vibrio cholerae, Cryptosporidium parvum) 

Category C Diseases/Agents: Third highest priority agents include 
emerging pathogens that could be engineered for mass dissemination in 
the future because of availability, ease of production and dissemination, 
and potential for high morbidity and mortality rates and major health 
impact. 

• Emerging infectious disease threats such as Nipah virus and hantavirus 
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Appendix III: Categories of Information 
Technology for Bioterrorism-Related Systems 



In addition to the phases of an event (i.e., prevention and preparedness, 
event recognition, early and sustained response, and recovery) there are 
corresponding categories of IT, which play a vital role as the event 
progresses. These categories of IT serve different but related functions. 
For the purposes of this report, we categorized systems according to their 
primary purposes, as defined in a technology assessment for the Agency 
for Healthcare Research and Quality that was completed by the University 
of California San Francisco-Stanford Evidence-based Practice Center. 1 



While not all detectors include IT components, detection systems collect 
and identify potential biological agents in environmental samples, 
regardless of whether anyone has been exposed to a harmful level of a 
contaminant. Components of a detection system can include collection 
systems, particulate counters or biomass indicators, rapid identification 
systems, and integrated collection and identification systems. In general, 
detection systems have three parts: (1) a sampler or collector to 
concentrate the aerosol and preserve samples for further analysis, (2) a 
trigger component (often a particulate counter or a biomass indicator) 
that can identify the presence of a potentially harmful biological agent, 
and (3) an identifier to provide specific identification of the biological 
agent. 

Biological detection technologies are in a much less mature stage of 
development than chemical detectors. According to a February 2001 
report by the North American Technology and Industrial Base 
Organization (NATIBO), no single sensor detects or identifies all biological 
agents of interest. 2 Several different technologies may be needed as 
components of a layered detection network. It is difficult to distinguish 
specific biological agents from naturally occurring background materials. 
Real-time detection and measurement of biological agents in the 
environment is challenging because of the number of potential agents to 
be identified, the complex nature of the agents themselves, the countless 
number of similar micro-organisms that are a constant presence in the 
environment, and the minute quantities of pathogen that can initiate 



University of California San Francisco-Stanford Evidence-based Practice Center, 
Bioterrorism Preparedness and Response: Use of Information Technologies and Decision 
Support Systems, (Stanford, CA, June 2002). 

2 North American Technology and Industrial Base Organization, A Primer on Biological 
Detection Technologies, (Fairfax, VA: February 2001). 
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Technology for Bioterrorism-Related Systems 



infection. Most available systems are point detection systems that are 
either in the field-testing stage or still in the laboratory. The NATIBO 
assessment also reported that current systems for detecting biological 
agents are large, complex, expensive, and subject to false results. 

The 10 detection systems identified in the inventory include IT 
components. These systems make use of IT to record and send data to a 
network. Table 2 shows systems included in the inventory that were 
developed and operated by DOE and DOD for use in both military and 
civilian settings. 



Table 2: Summary of Detection Systems by Agency 


Type of detector 


Agency 


Number of 
systems 


Status 


Curent/proposed 
monitored populations 


Collector 


N/A 





N/A 


N/A 


Identifier 


DOE 


1 


Pilot 


Local and event-specific 


Trigger 


DOE 


1 


In development 


Not available 


Integrated collector, 
identifier, and trigger 


DOE 


4 


In development 


Local, environment, and large-scale civilian events 




DOD 


4 


2 - Operational 
2 - Pilot 


Military facilities and personnel 



Source: GAO. 

Note: N/A means not applicable. 



One example of a detection system is the Biological Aerosol Sentry and 
Information System (BASIS). This is a portable system of networked air 
sampling units that is capable of detecting airborne biological incidents at 
large gatherings such as political conventions and major indoor and 
outdoor sporting events. In the mid-1990s, DOE's national laboratories 
began work to detect and prevent bioterrorism under the Chemical- 
Biological National Security Program. As part of that work, Lawrence 
Livermore and Los Alamos laboratories developed BASIS, which has been 
used during the Olympics and other events to collect air samples and 
provide information on the time, duration, amount, and types of biological 
releases. It uses barcodes to maintain data that link samples to filters 
taken from specific sampling units. These data are analyzed at field 
laboratories and tracked with BASIS. If a biological agent is detected, it 
will provide information about the type of agent as well as where and 
when it was collected. BASIS also estimates exposure levels and durations 
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to assist public health officials in identifying the population that requires 
treatment. It was adapted to process samples from the Bio Watch program 
beginning in February 2003. 



Surveillance is the ongoing collection, analysis, and interpretation of 
disease-related data to plan, implement, and evaluate public health 
actions. Surveillance systems differ from detection systems in that they 
monitor the actual incidence of disease or illness. Without an adequate 
surveillance system, officials cannot know the true scope of existing 
health problems and may not recognize new diseases until many people 
have been affected. The surveillance network relies on the participation of 
health care providers, laboratories, state and local health departments, 
and other nontraditional data sources across the nation. Surveillance 
systems monitor and track abnormal situations that require 
epidemiological actions and that direct preventive measures by guiding 
resource allocation and assessing interventions. The most important 
aspect of a surveillance system is its ability to detect an outbreak at a 
stage when intervention may affect the expected course of events. It is the 
public health officials' most important tool for detecting and monitoring 
both existing and emerging infectious diseases. 

Surveillance activities may be either active or passive. Passive surveillance 
relies on physicians, laboratory and hospital staff, and others to take the 
initiative in reporting data to health departments. Passive systems may be 
inadequate to identify a rapidly spreading outbreak in its earliest and most 
manageable stage because there is a chronic history of underreporting and 
a time lag between diagnosis of a condition and the health department's 
receipt of a report. Active surveillance relies on public health officials to 
take the initiative to periodically contact laboratory officials to gather 
data. Active surveillance produces more complete information than 
passive, but is more costly to use for data collection activities. 

Timely and reliable data are essential components of public health 
assessment, policy development, and assurance at all levels of 
government; however, the current capacity of public health surveillance is 
weakened by gaps and fragmentation. Fragmentation has developed in 
surveillance systems in part because states and localities have not 
developed uniform data collection procedures, storage, and transmission. 
In February 1999, we reported on gaps in the nation's public health 
surveillance network for important emerging infectious diseases; and we 
recommended that CDC, in collaboration with state, local, and other 
public health officials, reach consensus on the core capabilities needed at 
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each level of government, including IT capabilities. 3 Another key factor 
shaping the development of surveillance systems is that, historically, 
investment in these systems has been targeted to specific programs (e.g., 
tuberculosis, sexually transmitted diseases, etc.), resulting in a patchwork 
of surveillance efforts across the spectrum of infectious disease threats 
and other programs. 

Most surveillance systems are identified by the type of data they collect; 
there are eight categories of surveillance: 

1. Foodborne illness surveillance — systems that collect, process, and 
disseminate information on foodborne pathogens or illness. In 
September 2001, we reported weaknesses in several of CDC's 
surveillance systems for foodborne illness; we reported that these 
systems had limited usefulness because there were gaps in the data 
and because CDC did not release the data in a timely manner. 4 

2. Hospital-based surveillance — systems that collect data on hospital- 
acquired infections for hospital infection control officers. Their 
primary purpose is to track hospital acquired infections, not to identify 
undiagnosed infections from the community. However, hospital-based 
surveillance systems could play two roles in the early detection of 
emerging infections: the identification of a cluster of recently admitted 
patients, which might suggest a community-based outbreak, and the 
identification of a cluster of cases within the hospital that may suggest 
inpatients with an unrecognized communicable disease. 

3. Influenza surveillance — systems that collect data on influenza-like 
illness. These systems are relevant to bioterrorism surveillance 
because many bioterrorism-related illnesses present with flu-like 
symptoms. Influenza surveillance could also serve as a model because 
these systems integrate clinical and laboratory data for the detection 
of influenza outbreaks and are coordinated global efforts; they fulfill 
needs similar to those of surveillance for bioterrorism. 



3 U.S. General Accounting Office, Emerging Infectious Diseases: Consensus on Needed 
Laboratory Capacity Could Strengthen Surveillance, HEHS-99-26 (Washington D.C.: 
February 5, 1999). 

4 U.S. General Accounting Office, Food Safety: CDC Is Working to Address Limitations in 
Several of Its Foodborne Disease Surveillance Systems, GAO-01-973 (Washington, D.C.: 
September 7, 2001). 
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4. Laboratory and antimicrobial resistance 5 surveillance — systems 
that facilitate the collection, analysis, and reporting of notifiable 
pathogens and of antimicrobial resistance data that could potentially 
facilitate the rapid detection of a biological agent. Laboratory 
surveillance systems are an essential component of any system for the 
detection of a covert bioterrorism event, both for the detection of 
uncommon organisms (e.g., smallpox, anthrax, and Ebola) and 
common organisms with unusual patterns of antimicrobial resistance. 

5. Network of clinical reports — systems that collect and analyze 
clinical reports from individual clinicians and sentinel networks. 6 The 
growth of such networks has generated a demand for information 
systems capable of automating data collection, analysis, reporting, and 
communication. 

6. Syndromal surveillance — systems that collect data on the earliest 
signs and symptoms caused by most biological agents. 7 Therefore, 
patients with these syndromes are the targets of syndromal 
surveillance programs. These systems are still considered 
experimental, and there is no widely accepted definition for any of 
these syndromes. As a result, syndromal surveillance systems are 
widely heterogeneous with respect to the syndromes under 
surveillance and how each syndrome is defined. 

7. Zoonotic and animal disease surveillance — systems that collect, 
process, and disseminate information on zoonotic and animal diseases. 
There are concerns that a bioterrorist attack could involve the 
dissemination of a zoonotic illness among animal populations with the 
intention of infecting humans or livestock and causing economic and 
political/economic chaos. Early detection of such an event requires 
effective rapid detection systems for use by farm workers, meat 
inspectors, and veterinarians, with real-time reporting capabilities to 
public health officials. 



"Antimicrobial resistance is the result of microbes changing in ways that reduce or 
eliminate the effectiveness of drugs, chemicals, or other agents to cure or prevent 
infections. 

6 A sentinel network is a disease surveillance program that involves the collection of health 
data on a routine basis by clinicians with some training in reporting communicable disease. 

'Symptoms include flu-like illness, acute respiratory distress, gastrointestinal symptoms, 
febrile hemorrhagic syndromes, and febrile illnesses with either dermatological or 
neurological findings. 
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8. Other — systems that collect sufficiently different surveillance data 
that they do not fit into the described categories. These systems could 
be valuable additions to surveillance networks that integrate data from 
clinicians, hospitals, and laboratories. 

Our inventory identifies 34 surveillance systems, which monitor and track 
specific categories of illness and disease. Some of CDC's surveillance 
systems have been used for several years and only consist of a database, 
while others, such as NEDSS, are more comprehensive. As table 3 
indicates, 4 systems are in development, 2 are currently being evaluated as 
pilots, 1 is being planned, and 27 are operational. 



Table 3: Summary of Surveillance Systems by Agency 



I yp" ot surveillance bybicin 


Mgency 


Number of 

bybLcmb 


Qtati ie 


Current/proposed monitored 
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HHS 


4 


Onprational 
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USDA 


3 


Operational 


Slaughter, food processing, retail, and 
import establishments 


Hospital-based surveillance 











Influenza 


HHS 


1 


Operational 


People with reported cases of 
influenza-like illness 


Laboratory and antimicrobial 
resistance 


HHS 


4 


Operational 


Local and national 




VA 


1 


Operational 


VA hospital population 




USDA 


1 


Planning 


National population 


Networks of clinical reports 


DOD 


1 


Operational 


Navy enlisted personnel 




HHS 


3 


2 - Operational 
1 - Pilot 


Local, national, and international 
populations 


Syndromal 


DOD 


6 


2 - In development 

3 - Operational 
1 - Pilot 


Military personnel and national 
populations 




DOE 


1 


Operational 


Local, state, and regional populations 




HHS 


3 


1 - In development 

2 - Operational 


Individuals crossing US-Mexico border 


Zoonotic diseases 


USDA 


2 


Operational 


Participating disease control programs 
or slaughter test subjects 




HHS 


1 


Operational 


National population 
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Type of surveillance system 


Agency 


Number of 
systems 


Status 


Current/proposed monitored 
populations 


Other 


DOE 


1 


In development 


Local populations 




HHS 


2 


Operational 


Local populations 



Source: GAO. 



One example of a surveillance system is DOD's Electronic Surveillance 
System for the Early Notification of Community-based Epidemics 
(ESSENCE). ESSENCE was developed to support early identification of 
infectious disease outbreaks in the military, and to provide 
epidemiological tools for improved investigation. ESSENCE uses 
ambulatory data that are collected from its military hospitals and clinics 
and transmitted daily to a central database. By comparing the daily 
analyses to historical trends, it can identify patterns that suggest an 
infectious disease outbreak. ESSENCE uses geo-spatial data 8 to cluster 
syndromic groupings based on the locations of occurrences. By getting 
daily reports and automatic alerts, epidemiologists can track, in near real- 
time, the syndromes that are being reported in a given region. It 
incorporates privacy algorithms and supports agent-based response using 
artificial intelligence software, reasoning, data mining, and visualization 
tools. DOD's use of electronic medical records enhances its ability to 
quickly collect data for syndromic surveillance. In the future, the 
department plans to find, analyze, and add new data sources to the system. 



Diagnostic and 
Clinical Management 



For the purposes of this report, we defined these as systems with potential 
utility for enhancing the likelihood that clinicians consider the possibility 
of bioterrorism-related illness and treat patients accordingly. 

Diagnostic systems are generally designed to assist clinicians in 
developing a differential diagnosis for a patient who has an unusual 
clinical presentation and consist of three different types: general 
diagnostic decision support systems (DSS), radiology interpretation 
systems, and natural language processing techniques. 9 General diagnostic 



Geo-spatial data is information that identifies the geographic location and characteristics 
of natural or constructed features and boundaries on the earth. This information may be 
derived from, among other things, remote sensing, mapping, and surveying technologies. 

^Radiology interpretation systems are those technologies that could be used to automate 
the interpretation of radiological images. Natural language processing is the process of 
converting information expressed in spoken and written human languages into computer 
input via specialized software. 
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DSS are those designed to assist clinicians in developing a specific 
diagnosis for a patient who has unusual signs and symptoms. For these 
systems to be useful in the event of a covert bioterrorist attack, they 
should prompt clinicians to consider the possibility of bioterrorism-related 
illness as a potential cause of the symptoms, thereby increasing the 
probability that the clinician will perform appropriate diagnostic testing. 
In addition, since many biothreat agents can cause pulmonary disease, x- 
rays or other radiological tests would be a common diagnostic procedure 
performed on patients who might benefit from either the use of radiology 
interpretation systems that can increase the diagnostic accuracy of 
radiology reports, or the use of natural language processing techniques to 
automate the identification of disease concepts in the free text found in 
diagnostic reports. 

Clinical management systems can also make recommendations to 
clinicians by abstracting clinical information from electronic medical 
records, applying a set of rules, and generating patient-specific 
management and prevention recommendations. In general, these systems 
are limited to institutions with electronic medical records and robust 
medical informatics programs. There are no known systems specifically 
designed to provide recommendations to clinicians or public health 
officials for management of a bioterrorism event. Of the systems that are 
known to exist, they provide recommendations at the point of care, 
typically when the clinician enters the electronic medical record of the 
patient in question. 

These diagnostic and clinical management systems are similar in that they 
both use clinical information about a patient, apply information from a 
knowledge base, and generate a list of possible diagnoses or a list of 
management recommendations. Based on this similarity, we have included 
them in the same category of IT. 

Of the federal agencies included in our review that utilize other diagnostic 
and clinical management systems for their health care delivery 
operations — DOD, VA, and HHS's Indian Health Services — none has 
implemented these particular applications as defined above. 



The purpose of communications and reporting systems is to facilitate the 
secure and timely delivery of information in the midst of a public health 
emergency to the relevant responders and decision makers, so that 
appropriate action can be undertaken. During a public health emergency, 
clinicians must be able to communicate rapidly with their patients; public 



Communications 
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health officials must be able to communicate with other local, state, and 
federal officials, and laboratories must be able to communicate diagnostic 
test results. Robust security measures that ensure patient confidentiality 
and resist cyber attacks are also a necessary component of any health- 
related communication system. 

Our systems inventory contains 10 communications systems. While 
communications within the public health community still depend largely 
on telephone- and paper-based systems, they are moving to Web-based and 
electronic data transmission. CDC is responsible for many of the 
communications systems under development in HHS; however, some of 
the systems are not yet fully implemented at the state or local levels, and 
this could negatively affect communication of health information to the 
public. As table 4 shows, all 10 of these systems are operational. 



Table 4: Summary of Communications Systems by Agency 



Agency 


Number of 
systems 


Targeted users 


Status 


Frequency of data 
exchange 


Method of data 
capture and 
exchange 


DOD 


2 


Navy and Marine medical officials 


Operational 


1 - Monthly 
1 - As needed 


Electronic 


HHS 


5 


Public health officials, epidemiologists, 
and veterinarians 


Operational 


2 - Continuous 

1 - Every 10 minutes 

2 - Daily 


Predominantly 
Web-based 


USDA 


3 


USDA officials and state/federal 
animal health agencies 


Operational 


3 -Continuous 


Web-based, paper, 
and electronic 



Source: GAO. 



The Health Alert Network (HAN) is one example of a nationwide 
communications system that is currently being developed by CDC. HAN is 
to serve as a platform for (1) distribution of health alerts, (2) 
dissemination of prevention guidelines and other information, (3) distance 
learning, (4) national disease surveillance, (5) electronic laboratory 
reporting, and (6) communication of bioterrorism-related initiatives to 
strengthen preparedness at the local and state levels. HAN is intended to 
strengthen the capacity of state and local health departments by serving as 
an early warning and response system for bioterrorism and other health 
events. HAN provides the capacity to send urgent health alerts to local 
agencies via broadcast technologies, such as fax services and autodialing. 

HHS has awarded grants to all 50 states, 3 large cities, 3 counties, 8 
territories, and the District of Columbia for HAN implementation. When 
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completed, HAN is to provide high-speed, secure Internet connections for 
local health officials; on-line, Internet- and satellite-based distance 
learning systems; and early warning broadcast alert systems. HAN 
currently provides secure Internet access to two-thirds of the nation's 
counties, and at least 13 states have high-speed Internet access to all of 
their counties. State and local governments may also use CDC funding to 
expand HAN to community partners such as health organizations and 
major hospital networks. 

In addition to enhancing state and local communications, at the time of 
our review, CDC had provided grants to three local centers for public 
health preparedness. The centers are considered models of integrated 
communications and information systems across multiple sectors, 
advanced operational readiness assessment, and comprehensive training 
and evaluation. New York's Monroe County Center uses its own health 
alert network to link hospitals, insurers, and county health care agencies 
to doctors, pharmacies, and clinics for emergency and routine 
communications. Monroe County also developed a unified platform for the 
community to view and track the status of their emergency departments 
and the number of available beds for a specialty unit within a hospital. In 
addition to working on syndromic surveillance, Colorado's Denver County 
Center has developed a bi-directional alert communication and 
notification system for its public health partners and has explored the use 
of redundant response system tools for rapidly notifying key local public 
health partners in the event that traditional phone service is lost. 



Supporting 
Technology 



Supporting technologies are tools or systems that provide information for 
the other categories of systems (e.g., detection, surveillance, etc.). During 
our discussions with federal officials, we found that many projects still in 
applied research and development are intended to support a particular 
component associated with a type of system, such as detection devices. 
These projects offer promising techniques that are not currently in use. 
For example, DOE's national laboratories conduct research into new 
detection and surveillance techniques that, when developed, may be fully 
deployed into the public health infrastructure. DOE's Los Alamos National 
Laboratory (LANL) is conducting the Enabling Analytical and Modeling 
Tools for Enhanced Disease Surveillance research project. Its objective is 
to develop analytical tools to support public health officials in quickly 
identifying emerging threats so they can respond accordingly. Subsets of 
this research are incorporated into ongoing projects. The Forensics 
Internet Research Exchange is another LANL research project that is 
intended to connect a network of laboratories and government agencies 
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through a secure virtual private network (VPN) so that they can share 
genetic sequencing data for identifying strains of biological organisms. In 
addition, the Defense Advanced Research Projects Agency's Bio-ALIRT 
program is a research project to further enable early detection of 
biological events from artificial or natural causes. Its objective is to 
scientifically determine which nontraditional data sources (e.g., human 
behavior) are useful in enabling early detection of potential biological 
attacks. More detailed descriptions of these projects are included in 
appendixes IV through X. 

Simulation and computational modeling is another important — and still 
developing — technology for supporting bioterrorism preparedness and 
response. With the increase of computational power available in today's 
technology, and the increasing availability of data, we may soon be able to 
predict the course of emerging infectious diseases. LANL is piloting the 
Bioreactor Simulation Tools project, which models and analyzes biological 
systems in order to create models for predicting the spread of a biological 
agent. The DOD Chemical and Biological Defense program's Joint Effects 
Model incorporates simulation tools (used to create a hazard prediction 
model) that are expected to predict environmental effects. Another DOD 
project, the Joint Operational Effects Federation, is leveraging existing 
simulation capabilities to support the prediction of chemical and 
biological effects at various levels of operation. DOD's simulation tools 
were developed for military purposes. 

Our inventory includes 18 systems that are identified as supporting 
technologies. Twelve of these systems are operational, 3 are in 
development and 3 are being evaluated as pilots. 
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Table 5: Summary of Supporting Technologies by Agency 


Agency 


Number of 
systems 


Status 


USDA 


1 


Operational 


DOD 


1 


In development 


DOE 


6 


1 - Operational 

2 - In development 

3 - Pilot 


HHS 


5 


Operational 


EPA 


5 


Operational 



Source: GAO. 



Other Clinical 
Systems 



While they are not included within the scope of our systems inventory, 
there are other systems that will facilitate health care delivery during an 
act of bioterrorism or other public health emergency. These systems — 
such as electronic medical records — were excluded from the scope of this 
review because they are neither public health systems nor were they 
primarily developed for biodefense. Both DOD and VA have electronic 
medical information systems (i.e., Composite Health Care System and 
Veterans Health Information Systems and Technology Architecture), 
which enhance their ability to automate the collection of surveillance data 
for systems such as ESSENCE. Automated medical information systems 
can play an important role for clinicians during their response to a medical 
emergency, in documenting the treatment of illness and its outcome, and 
in collecting and sharing diagnostic test results. Electronic medical 
records can play a role during routine surveillance by serving as important 
data sources for public health surveillance. The use of electronic medical 
records could reduce the burdensome and costly use of paper-based 
processes, facilitating rapid access to data critical for near real-time public 
health surveillance. 
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USDA became involved in activities concerning bioterrorism because of 
the increasing realization that the food supply may become a vehicle for a 
biological attack against the civilian population. Biological attacks on the 
health of animals and plants are also important to recognize because there 
are a number of diseases and toxins harmful to humans that can be spread 
by animals and plants. USDA's Homeland Security staff within the Office 
of the Secretary is responsible for coordinating activities on terrorism 
across USDA. In addition, three of USDA's services have been involved in 
bioterrorism research and preparedness: 1 

• Agricultural Research Service (ARS), 

• Animal and Plant Health Inspection Service (APHIS), and 

• Food Safety Inspection Service (FSIS). 

ARS has conducted research to improve onsite rapid detection of 
biological agents in animals, plants, and food and has improved its 
detection capacity for diseases and toxins that could affect animals and 
humans. APHIS has a role in responding to biological agents that are 
zoonotic (i.e., capable of affecting both animals and humans). APHIS has 
veterinary epidemiologists to trace the source of animal exposures to 
diseases. FSIS provides emergency preparedness for foodborne incidents, 
including bioterrorism. 

USDA identified 10 information systems and supporting technologies. 



Portions of ARS and APHIS are now part of DHS. 
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Department of Agriculture 


Animal and Plant Health Inspection Service 




Emergency Response Management System (EMRS) 


Type of system: 

Surveillance 



EMRS is used to manage and investigate outbreaks of animal diseases in the United States. This Web-based task management 
system was designed to automate many of the tasks that are routinely associated with disease outbreaks and animal emergencies. 
EMRS is used for routine reporting of foreign investigations of animal disease, state-specific disease outbreaks or control programs, 
classic national responses, or natural disasters involving animals. EMRS also has a mapping feature, which allows for real-time 
identification of outbreaks to enable responders to respond more quickly by providing high-resolution maps to decision makers, 
government agencies, and the public. The system interfaces with state and federal diagnostic laboratories for reporting test results. 



External collaborating 


System is operational 


Used primarily by state 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




and federal animal 


$565,000 


$615,000 






health agencies 







Future plans: Integrate with U.S. Forest Service's ROSS system. 



Generic Disease Data Base (GDB) 


Type of system: 




Surveillance 



GDB monitors progress in disease control programs, such as the brucellosis and tuberculosis programs. GDB is a core national 
database for animal health information. Each state has its own local GDB that is limited to its own data, unless it has obtained 
permission from other states to access their GDB data. There is also a national GDB at Ft. Collins, CO, which is used for the 
National Scrapie program. GDB is used for both domestic disease control programs and foreign animal disease investigations. 



External collaborating 


System is operational 


Used primarily by state 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




and federal animal 


$550,000 


$700,000 






health agencies 







Future plans: Improvements to make GDB more user-friendly to better serve APHIS'S needs. 
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Automated Import Information System (AIIS) 


Type of system: 




Supporting technology 



AIIS assigns reinspection tasks to import inspectors who are stationed at ports of entry. Reinspection of imported goods is based 
upon foreign product, plant, and country compliance histories. Restrictions on imported products ensure that various species and 
products do not enter the United States food supply. 



External collaborating 


System is operational 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




import inspectors at 
ports of entry and 
circuit supervisors 


Not available 


Not available 



Future plans: Subsequent enhancements to AIIS will include an Intranet application for reports and systems administration, a 
replicated database view to support future reporting requirements, and incorporation of additional business requirements when they 
are defined. USDA should complete these enhancements by the end of fiscal year 2003. 



Consumer Complaint Monitoring System (CCMS) 


Type of system: 




Surveillance 



CCMS is a database used to record, evaluate, and track all consumer complaints reported to the agency. This includes consumer 
complaints reported by a state or local health departments or other federal agencies. It also includes complaints that involve 
imported products recalled from the market. Several program areas have access to CCMS and are responsible for entering any 
consumer complaints that they receive into the system, including those from district offices and compliance officers, as well as the 
Food Safety Education and Communication staff. 



External collaborating 


System is operational 


Used primarily by USDA 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




officials 


Not available 


Not available 



Future plans: Enhancing CCMS so that it will be able to exchange electronic data with state and local public health agencies in a 
secure manner using the Internet. This enhancement is expected to decrease the amount of time it takes to identify and respond to 
possible bioterrorism attacks and to other foodborne outbreaks. Syndromic surveillance capability will be programmed into CCMS 
for common foodborne illnesses and for possible bioterrorism attacks. 




Type of system: 

Surveillance 



FAST stores information on tested samples and provides information on antimicrobial residues in animal tissues. Test results are 
used for risk assessment and decision support purposes, early detection of problem products, active food safety surveillance, and 
evaluation of potential threats to the American food supply. 



External collaborating 


System is operational 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




USDA officials 


Not Available 


Not available 



Future plans: FAST will be replaced by the implementation of eSample, a system for direct data entry by inspection personnel, 
and by a corporate database system. 
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Meat and Poultry Hotline (HOTLINE) 


Type of system: 




Communications 



The purpose of the HOTLINE database is to collect, store, and report data on consumer food safety information requests and 
complaints. Information for the system is obtained from the consumer via telephone. Administrators of the Consumer Complaint 
Monitoring System periodically poll the HOTLINE database and extract data about issues of concern. 



External collaborating 
partner: None 


System is operational 


Used primarily by meat 
and poultry hotline 
technical information 
specialists 


FY 2002 IT cost: 

Not available 


Est. FY 2003 IT cost: 

Not available 


Future plans: The possible integration of a call distribution system with the d 


atabase. The upgrade could take 5 to 10 years. 


Laboratory Electronic Application for Results Notification (LEARN) 


Type of system: 

Communications 



LEARN transmits laboratory test results that detect the presence of pathogens and residues of drugs, pesticides, and other 
chemicals on specimens taken from meat, poultry, and egg products. The system facilitates and expedites the reporting of food 
product contamination to agency personnel and the industry, reducing the chances of public consumption. Products are randomly 
sampled or collected based upon suspected health hazards, and results are reported through the LEARN system. 



External collaborating 


System is operational 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




USDA officials 


Not available 


$92,185 



Future plans: Continued enhancements to the existing application to improve user-friendliness and to add information and reports 
that are not currently included in the application. Plans also include integration of the system with a new laboratory information 
system and a new headquarters sample information system. 



Microbiological and Residue Computer Information System (MARCIS) 


Type of system: 




Surveillance 



MARCIS contains sample identification information and results for analyses submitted by inspection personnel to laboratories. 
These samples consist of meat, poultry, and egg products; and they are analyzed to ensure that they are safe, wholesome, 
unadulterated, and properly labeled. The samples are tested because they bear or contain residues of drugs, pesticides, other 
chemicals, and microbiological pathogens. Test results are used to alert agency personnel and the industry of contaminations and 
threats to consumer health and the need for protective actions such as product recalls. MARCIS is also used for risk assessment 
and decision support purposes, improving early detection of problem products, enabling active food safety surveillance, and 
evaluating potential threats to the food supply. 



External collaborating 


System is operational 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




USDA, FDA, and EPA 


Not available 


Not available 




officials 







Future plans: Replacement of MARCIS with the Laboratory Information Management System. This replacement system will serve 
an analytical purpose and will populate a corporate sampling database with laboratory information. 
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Pathogen Reduction Enforcement Program (PREP) 


Type of system: 




Communications 



PREP schedules tests, tracks samples, and generates a series of reports concerning testing eligibility and the status of test results. 
It collects and stores establishment address and product information as well as establishment food safety performance. It uses the 
information for scheduling and requesting the collection of food samples for microbiological pathogen testing. Test results are used 
to alert agency personnel and the industry of contaminations and threats to consumer health and the need for protective actions, 
such as product recalls. PREP is also used for risk assessment and decision support purposes, improving early detection of 
problem products, enabling active food safety surveillance, and evaluating potential threats to the American food supply. 



External collaborating 


System is operational 


Used primarily by 


FY 2002 IT cost: 




Est. FY 2003 IT cost: 


partner: None 




USDA officials 


Not Available 




Not available 



Future plans: Complete testing of new modules (e.g., eggs, retail, and special surveys). 



National Animal Health Laboratory Network (NAHLN) 


Type of system: 




Surveillance 



NAHLN is to link federal and state diagnostic labs for the reporting of cases with certain clinical signs or definite diagnosis. The 
types of case reported will be coordinated with CDC and include the use of data messaging and transfer standards. 



External collaborating 


System is in planning 


To be used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: HHS/CDC 




diagnostic laboratories, 


$0 


$250,000 






and CDC and USDA 










officials 







Future plans: Continue development of the database for 13 laboratories in fiscal year 2003, then further development for other 
diagnostic laboratories in fiscal years 2004 and 2005. 



Source: GAO analysis of USDA data. 
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Although DOD is primarily responsible for service members in the 
battlefield, the department often shares its research with other agencies to 
benefit the civilian population. DOD's Defense Advanced Research 
Projects Agency has been the central research and development 
organization for DOD, managing and directing basic and applied research 
and development projects for the department. In addition, the United 
States Army Medical Research Institute of Infectious Diseases 
(USAMRIID) conducts biological research dealing with militarily relevant 
infectious diseases and biological agents. USAMRIID provides professional 
expertise on issues related to technologies and other tools to support 
readiness for a bioterrorist incident, and also confirms diagnostic 
laboratory results for CDC's Laboratory Response Network. Some of 
DOD's systems, particularly those developed by the Joint Program Office, 
are shared between the services. 

DOD identified 14 information systems and supporting technologies. 



Department of D efense 



ir Force 



Global Expeditionary Medical System (GEMS) 



Type of system: 

Surveillance 



GEMS provides an integrated biohazard surveillance system that is capable of maintaining a global watch over Air Force personnel. 
It incorporates an electronic medical record as a basis for real-time data analysis. GEMS establishes records of medical encounters 
and rapid identification and notification of clinical events, and it integrates the symptom level surveillance that is critical for early 
detection of disease outbreaks and illnesses. With ongoing site and regional data review, population-specific analysis picks up 
disease trends to provide early warning of disease outbreaks or biological attacks. GEMS serves as the foundation for an Air Force- 
wide, integrated medical surveillance and command and control network. GEMS has four modules: patient encounter, theater 
occupational, public health deployed, and theater epidemiology. 



External collaborating 


System is operational 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




military health care 
providers, public health, 
and command and 
control 


$500,000 


Not available 



Future plans: Complete infrastructure development. 
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Lightweight Epidemiology Advanced, Detection and Emergency 


Type of system: 


Response System (LEADERS) 


Surveillance 



LEADERS is expected to improve the ability to identify and confirm covert biological warfare incidents or significant natural disease 
outbreaks. LEADERS is to be a comprehensive system that supports joint military and civilian medical surveillance initiatives. 



External collaborating 
partner: None 


System is in 
development 


Used primarily by military 
health care providers, 
public health, and 
command and control 


FY 2002 IT cost: 

Not available 


Est. FY 2003 IT cost: 

$3,000,000 


Future plans: To complete infrastructure development and to attain funding for clinical interface. The next phase will focus on 
development of medical surveillance algorithms for specified diseases representing the most serious bioterrorism threats. 






Army 






Airbase/Port Detector System (Portal Shield) 


Type of system: 

Detection 



The Portal Shield sensor system was developed to provide early and definitive warning of biological threats for high-value, fixed-site 
assets, such as air bases and port facilities. Portal Shield can detect and identify up to eight biological warfare agents 
simultaneously, within 25 minutes. Portal Shield uses a "smart logic" algorithm to help reduce false positives and consumables. The 
network can operate in a surveillance mode as well as a random or manual sample mode. In addition to the biological detection 
hardware, each sensor is equipped with its own meteorological station and global positioning system. 



External collaborating 
partner: None 


System is operational 


Used primarily by military 
personnel at fixed asset 
sites (e.g., air bases and 
port facilities) 


FY 2002 IT cost: 

$150,000 


Est. FY 2003 IT cost: 

$0 


Future plans: Not available. 


Biological Integrated Detection System (BIDS) 


Type of system: 

Detection 



BIDS provides early warning and identification capability in response to a large area biological warfare attack. It is a detection suite 
in a shelter that is mounted on a dedicated vehicle with an independent power supply. Other BIDS elements include collective 
protection, environmental control, and storage for supplies such as a global positioning system and radios. BIDS was designed to 
utilize multiple biological detection technologies in a layered, complementary manner to maximize detection and presumptive 
identification capabilities. BIDS is used for warning and for confirming that a biological attack has occurred. It provides presumptive 
identification of the biological agent being used and produces a sample for laboratory analysis. 



External collaborating 


System is operational 


Used primarily by Army 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




reserve and active 


$425,000 


$0 






chemical companies 







Future plans: Replacement by JBPDS in fiscal year 2004 and full automation of real-time detection and identification of the full 
range of biological agents. 
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Type of system: 

Surveillance 



EWORS aids in the collection of standardized medical data, particularly for making area-specific and regional comparisons for trend 
analysis of the data in order to target early warning outbreak recognition of infectious diseases. EWORS provides for timely and 
accurate dissemination of outbreak information, leading to effective intervention measures, including investigative and containment 
activities. It establishes baseline measures for trend analysis that is used to differentiate outbreak from non-outbreak disease 
occurrence; employs a syndromic approach in contrast to disease-specific reporting classifications; and disseminates real-time 
information and key-function data analysis for instant and programmed interpretation. EWORS integrates public health and hospital 
networks and was designed as a complementary system for conventional surveillance methodologies. 



External collaborating 


System is operational 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: Indonesia's 




national outbreak 


$200,000 


$300,000 


Ministry of Health 




response agencies 







Future plans: Establishment of the system in the Americas and continued expansion in Southeast Asia. 




Type of system: 

Surveillance 



ESSENCE is used in the early detection of infectious disease outbreaks and it provides epidemiological tools for improved 
investigation. It collects ambulatory data from hospitals and clinics in a central database on a daily basis. Epidemiologists can 
track— in near real-time— the syndromes being reported in a region through a daily feed of reported data. ESSENCE uses the daily 
data downloads, along with traditional epidemiological analyses that using historical data for baseline comparisons and more cutting 
edge analytic methods such as geographic information system. Analysts have implemented an alerting algorithm methodology to 
detect localized outbreaks and purely temporal methods for low-level, scattered threats. DOD public health professionals use 
information from ESSENCE to make crucial decisions about potential health emergencies, based on verified and current data. 



External collaborating 


System is operational 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




military health officials 


$400,000 


$500,000 



Future plans: To improve the interface and find, analyze, and add new data sources. ESSENCE is being upgraded to incorporate 
the use of nontraditional civilian data sources; it is currently operational in the greater Washington, D.C. area. This expanded 
capability integrates both military and civilian health data with daily records of pharmacy sales, school absenteeism, and other 
sources, to allow for early warning of emerging infections. 



Embedded Common Technical Architecture (ECTA) 


Type of system: 

Supporting technology 


ECTA will provide military personnel with sensor connectivity, analysis, and warning and reporting capability for Joint Service combat 
platforms, command and control centers, and fixed sites. 


External collaborating 
partner: None 


System is in 
development 


Used primarily by defense 
nuclear, biological, and 
chemical specialists 


FY 2002 IT cost: 

Not available 


Est. FY 2003 IT cost: 

Not available 



Future plans: ECTA will merge the current capabilities of the Multipurpose Integrated Chemical Agent Alarm and the JWARN 
system and provide additional data processing, production of reports, and access to specific data to improve the efficiency of limited 
personnel assets. It will consist of the hardware and software required to provide sensor connectivity and analysis between detectors 
and service-specific systems. The JWARN-ECTA will transfer data automatically from and to the actual detector and will provide 
commanders, units, and systems with analyzed data for disseminating warnings down to the lowest level of the battlefield. 
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Joint Biological Point Detection System (JBPDS) 


Type of system: 




Detection 



JBPDS detects, identifies, samples, collects, and communicates the presence of biological warfare agents in order to enhance the 
survivability of U.S. forces. It consists of complementary trigger, sampler, detector and identification technologies that allow it to 
rapidly and automatically detect and identify biological threat agents. Its suite of tools will be capable of identifying biological warfare 
agents in less than 15 minutes. JBPDS is in low-rate initial production and limited procurement through fiscal year 2006. 



External collaborating 
partner: None 


System is operational 


Used by military health 
officials and other 
service personnel 


FY 2002 IT cost: 

$489,000 


Est. FY 2003 IT cost: 

$560,000 


Future plans: JBPDS is scheduled to begin full production in fiscal year 2007. The next stage will focus on reducing size, weight, 
and power consumption while increasing system reliability. JBPDS will also identify up to 26 agents simultaneously and will interface 
withJWARN. 


Joint Warning and Reporting Network (JWARN) 


Type of system: 

Detection/Communication 


JWARN employs warning technology to collect, analyze, identify, locate, report, 
potentially contaminated areas. It gathers information from detectors and uses tr 
and to display near real-time results to onsite commanders. JWARN will be emp 
dissemination down to the lowest level on the battlefield and linked to a global cc 


and disseminate information related to threats and 
lis information to compute toxic corridors and attacks 
oyed in making decisions about warning 
jmmand and control system. 


External collaborating 
partner: Military forces 


System is being piloted 


Used primarily by 
defense specialists 
and other designated 
personnel located at 
command and control 
centers 


FY 2002 IT cost: 

Not available 


Est. FY 2003 IT cost: 

Not available 



Future plans: Fielding of JWARN will begin in fiscal year 2004. Plans include using the full JWARN capability to provide 
commanders with automatic data from sensors and detectors. 



Navy 


Epidemiological Interactive System (EPISYS) 


Type of system: 

Surveillance 



EPISYS is a program that enables rapid assessment of disease trends in order to focus research efforts of epidemiologists. It was 
developed to integrate Navy inpatient hospitalization data with career history and demographic data to form a single system with a 
flexible interface. It is capable of detecting and flagging diagnostic categories that show rates in excess of their historical threshold 
values. This surveillance capability allows for the early detection of increased illness rates so that intervention can be started early. 
Using EPISYS, users can rapidly answer basic epidemiological questions regarding disease and injury rates. 



External collaborating 


System is operational 


Used primarily by Navy 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




health researchers 


Not available 


Not available 



Future plans: Not available. 
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Epidemiology Wizard (EPIWIZ) 


Type of system: 




Communications 



EPIWIZ is a research tool that was developed to organize SAMS data for further analysis of shipboard illness and injury data. 
EPIWIZ is expected to enhance the Navy's medical readiness by converting SAMS medical encounter data into surveillance 
information. It will provide Navy medical personnel easy access to shipboard sick-call information so they can monitor trends, 
prevent injuries and diseases, facilitate reporting, and enhance medical outcomes. EPIWIZ allows the user to display SAMS medical 
encounter data in a spreadsheet format to facilitate data analysis. This improved data analysis results in closing the gap between 
medical occurrence and preventative intervention. 



External collaborating 


System is operational 


Used primarily by Navy 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




health researchers 


Not available 


Not available 



Future plans: Not available. 



Field Medical Surveillance System (FMSS) 


Type of system: 




Surveillance 



FMSS is designed to help detect emerging health problems that might occur during foreign deployments or conflicts. FMSS can help 
field staff to determine incidence rates; project short-term trends; profile the characteristics of the affected population by person, 
time, and place; track the mode of disease transmission; and generate various graphs and reports. Once data are entered for a 
patient, the input is processed, and compatible diagnoses are presented in order of probability, with biological weapons agents 
highlighted. FMSS also provides on-line access to medical reference data and an interface to the GIDEON database — a well-known 
knowledge database designed to help diagnose most of the world's infectious diseases based on the patient's signs, symptoms, and 
laboratory findings. Many FMSS features have now transitioned over to the Navy's Medical Data Surveillance System and to other 
development projects. 



External 


System is 


Used primarily by military 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


collaborating 


operational 


health officials 


Not available 


Not available 


partner: None 











Future plans: Not available. 



Medical Data Surveillance System (MDSS) 


Type of system: 




Surveillance 



MDSS is an interactive Web application for collecting data and identifying changes in rates of naturally occurring injuries and 
illnesses found within routinely collected clinical data on active duty personnel. It compiles routine reports on disease and non-battle 
injury rates and generates special reports to assist medical staff to investigate the onset of disease and to evaluate the effectiveness 
of preventive measures. By applying advanced analytic techniques, MDSS can detect shifts in disease trends and outbreaks with 
minimal historical information on illness patterns characteristic of the area of interest, thereby making it particularly suitable for 
theater operations. These techniques also facilitate ad hoc analysis. MDSS is being configured to meet certification requirements 
so it can be deployed aboard Navy ships. MDSS is being pilot tested in the 18 th Medical Command in Korea and in Navy hospitals is 
Yokosuka, Japan and San Diego, California. 



External collaborating 


System is being piloted 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




military health officials 


$750,000 


$1 ,200,000 



Future plans: Continued research and development at an advanced research level and testing in a deployed environment at fixed 
facilities and operational units. 
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Navy Disease Reporting System (NDRS) 


Type of system: 




Communications 



NDRS provides for expedient and efficient submissions of reportable events. It may also be used to track and report disease and 
non-battle injuries. Its main purpose is to improve the compliance, timeliness, and reliability of disease reporting. Functions have 
been included to assist local command with state reporting, prevention programs, and contract tracing. NDRS enables users to 
determine what diseases are present in a particular country, how many outbreaks have occurred, and what treatments were used. 
NDRS streamlines reporting and provides ready access to epidemiological data. NDRS data are used to conduct trend analysis and 
to pool findings with data from other services. 



External collaborating 


System is operational 


Used primarily by Navy 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




health officials 


$500,000 


$500,000 



Future plans: Integration into the Navy's database for tracking medical encounters, known as the Shipboard Non-Tactical 
Automated Data Processing Automated Medical System (SAMS). 



Source: GAO analysis of DOD data 
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DOE is developing new capabilities to counter chemical and biological 
threats. DOE expects the results of its research to be public and possibly 
lead to the development of commercial products in the domestic market. 
DOE's Chemical and Biological National Security Program has conducted 
research on biological detection, modeling and prediction, and biological 
foundations to support efforts in advanced detection, attribution, and 
medical countermeasures. Several of DOE's national research laboratories 
(e.g., Lawrence Livermore, Los Alamos, Oak Ridge, and Sandia) have 
conducted biological and environmental research related to bioterrorism 
preparedness and response. 

DOE identified 14 information systems and supporting technologies. 



Department of Energy 


Lawrence Livermore National Lar. 


>oratory (LLNL) 


Autonomous Pathogen Detection System (APDS) 


Type of system: 

Detection 



APDS is an automated, podium-sized system that monitors the air for all three biological threat agents (bacteria, viruses, and 
toxins). The system has been developed to protect people in critical or high-traffic facilities and at special events. The system 
performs continuous aerosol collection, sample preparation, and multiplexed biological tests using advanced immunoassays to 
detect bacteria, viruses, and toxins. More than ten agents are assayed at once. Current research and development work is 
incorporating polymerase chain-reaction (PCR) techniques for detecting DNA. Single units can be operated to monitor a local space 
or a central conduit like an air-supply duct. In a more powerful application, a network of APDS units can be integrated with central 
command and control to protect larger areas. The APDS units can also be networked and integrated with other sensing and analysis 
systems to provide multifaceted detection and response capabilities. 



External collaborating 


System is in 


Used primarily for 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 


development 


special events of high 


Not available 


Not available 






value and potential 










fixed targets 







Future plans: APDS will move into redesign and piloting in fiscal year 2004. There will be a significant effort in communications 
and IT for networked instruments in field-testing and beyond. 
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Biological Aerosol Sentry and Information System (BASIS) 


Type of system: 




Detection 



BASIS is a large-area aerosol pathogen detection system. BASIS will provide early detection of biological incidents for special 
events, such as large assemblies and major sporting events. Planned for civilian use, it will detect a biological incident within a few 
hours of attack, early enough to allow public health officials to mount an effective medical response. BASIS was developed in close 
cooperation with federal, state, and local public health agencies to ensure support for real world operational needs. This system was 
adapted to process samples from the BioWatch 3 program, beginning in February 2003. 



External collaborating 
partner: None 


System is operational 


Used primarily for 
special events of high 
value and potential 
fixed targets 


FY 2002 IT cost: 

$800,000 


Est. FY 2003 IT cost: 

$350,000 


Future plans: BASIS funding ended in fiscal year 2002. The fate of BASIS for fiscal year 2003 was unknown. Given the likelihood 
of additional armed conflicts, LLNL anticipates seeing BASIS simultaneously deployed at multiple sites, such as cities. 


Computational Design of Pathogen Detection Assays (KPATH) 


Type of system: 

Supporting technology 


KPATH is an automated system that analyzes pathogen DNA signatures to build and maintain unique polymerase chain reaction 
(PCR) detection signatures. Signatures are requested by collaborators and are used in BASIS. DNA signatures developed by 
KPATH are now in use in the BioWatch program. 


External collaborating 
partner: HHS/CDC and 
FDA, USDA, and 
DOD/USAMRIID 


System is being 
piloted 


Used primarily by 
federal agencies (e.g., 
HHS, USDA, and DOD) 


FY 2002 IT cost: 

$2,201,200 


Est. FY 2003 IT cost: 

$1,000,000 



Future plans: KPATH will be LLNL's lead system for PCR diagnostic signature design. LLNL will continue enhancements to 
KPATH's DNA signature capabilities and will work on its ability to computationally predict protein signatures. 



"BioWatch is a multiagency program that involves air filter sampling to detect agents in 
certain cities. It is led by the Dept of Homeland Security and is supported by DOE, EPA, 
and HHS. 
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Biological Aerosol Sentry and Information System (BASIS) 


Type of system: 

Detection 


See BASIS under Lawrence Livermore National Laboratory. 


External collaborating 
partner: None 


System is operational 


Used by cities and 
special events 


FY 2002 IT cost: 

$3,000,000 


Est. FY 2003 IT cost: 

$3,000,000 


Future plans: See LLNL. 




Bioreactor Simulation Tools 


Type of system: 

Supporting technology 


Bioreactor Simulation Tools model and analyze biological systems (i.e., genetic networks, metabolic networks, and signal 
transduction networks). 


External collaborating 
partner: None 


System is being 
piloted 


Used primarily by 
molecular biologists 
and epidemiologists 


FY 2002 IT cost: 

$600,000 


Est. FY 2003 IT cost: 

$600,000 


Future plans: Development of a forward-looking capability to create detailed models for fundamental processes in molecular 
biology. 


Bio-Surveillance Analysis Feedback Evaluation and Response 
(B-SAFER) 


Type of system: 

Surveillance 


B-SAFER is a medical surveillance system using data from emergency departments, clinical laboratories, and nontraditional 
sources (e.g., RN hotline, drug information calls, ambulance services). B-SAFER recognizes an anomaly, either naturally occurring 
or caused by human intervention. B-SAFER is compliant with HIPAA and NEDSS. 


External 

collaborating partner: 

DOD 


System is in 
development 


Used primarily by the 
state and local 
homeland security 
community 


FY 2002 IT cost: 

Not available 


Est. FY 2003 IT cost: 

Not available 



Future plans: To project potential outcomes of an outbreak and the potential benefit of intervention techniques. 
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Flow Cytometry 


Type of system: 

Supporting technology 


Flow cytometry is used in the detection and identification of pathogens. It is a device comprised of lenses, lasers, computers and 
other high-tech equipment. They allow researchers to analyze, characterize, and sort thousands of biological cells, chromosomes or 
molecules in minutes. 


External collaborating 
partner: HHS/NIH 


System is being 
piloted 


Used primarily by public 
health officials, and 
diagnostic and research 
laboratory personnel 


FY 2002 IT cost: 

$300,000 


Est. FY 2003 IT cost: 

$100,000 


Future plans: Database and data analysis tool development. 


OpenEMed 


Type of system: 

Supporting technology 


OpenEMed is a distributed, open architecture, open source system that supports image, audio, and graphical data, creating a virtual 
patient record. OpenEMed has been used with B-SAFER and New Mexico's NEDSS integrated data repository. OpenEMed 
includes standard service components for person lookup and identity management, dictionary queries, a clinical data repository, 
and HIPAA-compliant access control. This software is available for use by the public. 


External collaborating 
partner: HHS 


System is 
operational 


Used primarily by public 
health officials and health 
care providers 


FY 2002 IT cost: 

$0 


Est. FY 2003 IT cost: 

$0 


Future plans: Not available. 


Reagentless Pathogen Biosensor 


Type of system: 

Detection 



This project will develop a point sensor for the detection of pathogens. This biosensor is being developed for the rapid detection of 
disease markers to aid in early diagnosis and could also be used for environmental and medical surveillance for homeland security. 



External collaborating 


System is in 


Used primarily by medical 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: HHS/NIH, and 


development 


personnel and first 


$2,000,000 


$1 ,800,000 


World Health 




responders 






Organization (WHO) 











Future plans: This biosensor is being adapted for early diagnosis of common infectious diseases including respiratory viruses and 
tuberculosis. There is a proposal pending to adapt it to medical surveillance for the Department of Homeland Security. 
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LandScan USA 



Type of system: 

Supporting technology 



LandScan USA is expected to be a high-resolution population distribution model that will provide timely and more spatially precise 
population and demographic information to support geographic analyses anywhere in the United States. In addition to its application 
for emergency planning in case of an attack or natural disaster, it has potential uses for socioenvironmental studies, including 
exposure and health risk assessment, and urban sprawl estimates. It can support improved development of emergency response 
plans in case of an attack or natural disaster, homeland security, environmental justice analyses, exposure/risk assessment, and 
evaluation of risks. The data it provides includes daytime and nighttime population distribution. 



External collaborating 
partner: DOD, EPA, HHS 


System is in 
development 


Used primarily by 
incident commanders 


FY 2002 IT cost: 

$600,000 


Est. FY 2003 IT cost: 

$1 ,500,000 


Future plans: Not available. 


SensorNet 


Type of system: 

Detection 





SensorNet is expected to be a comprehensive, national system for managing incidents for real-time detection, identification, and 
assessment of chemical, biological, radiological, and nuclear threats. It is intended to bring together and coordinate all necessary 
knowledge and response assets quickly and effectively. SensorNet is to consist of sensor technologies, real-time threat assessment, 
nationwide coverage, and nationwide real-time remote communications. SensorNet is currently under development as a standards- 
based architecture with encryption and access controls. 



External collaborating 


System is in 


Used primarily by first 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: NOAA 


development 


responders and personnel in 
intelligence, regulatory 
agencies and transportation 


$215,000 


$230,000 



Future plans: To continue operational prototypes and refine design for nationwide system. 



Sandia National Laboratory (SNL) 




Enabling Analytical and Modeling Tools for Enhanced Disease 


Type of system: 




Surveillance 


Supporting technology 





Enabling Analytical and Modeling Tools for Enhanced Disease Surveillance are analytical tools to detect unusual events from a 
natural background. These tools have been tested with influenza, respiratory illnesses, and dengue fever and are expected to be 
incorporated into ongoing projects. The flexibility of this project allows for tailoring to specific diseases. 



External collaborating 


System is in 


Used primarily by public 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 


development 


health officials 


$440,000 


$0 



Future plans: Provide a distributed software framework for integrating information from disparate sources; develop and integrate 
analytical tools for earlier detection of disease outbreaks. 
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Type of system: 

Detection 



ISMs are expected to be an intelligent integration of detection systems supporting wireless ad hoc networking. ISMs are intended to 
be used in support of DOD's BDI testbed, PROTECT, PROACT, and a project for the Mint. 



External collaborating 


System is in 


User information not 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 


development 


available 


$110,000 


$210,000 



Future plans: ISMs are currently under development; more capable computational components are to be integrated when 
available. 



uChemLab/CB 



Type of system: 

Detection 



uChemLab is a portable, hand-held chemical analysis system, which is fully self-contained and incorporates "lab on a chip" 
technologies. It is a sensitive device with fast response times in a low-power, compact package used for monitoring facilities. While 
uChemLab is currently being developed for chemical detection, it can also be used for biological agent detection. Portable, stand- 
alone devices for the analysis of chemical agents and protein biotoxins have been developed and tested at the research prototype 
stage. Current research is focused on improving the performance and expanding the capability of these and other such devices. 



External collaborating 
partner: DOD/JSRG 


System is being 
piloted 


Used primarily by first 
responders 


FY 2002 IT cost: 

$2,732,000 


Est. FY 2003 IT cost: 

$3,100,000 


Future plans: Analysis of additional agents. 




Rapid Syndrome Validation Project (RSVP) 


Type of system: 

Surveillance/Communication 



RSVP is designed to facilitate rapid communications. It provides early warning and response to emerging biological threats, as well 
as to emerging epidemics and diseases, by providing real-time clinical information about current symptoms, disease prevalence, 
and geographic location. RSVP provides a mechanism to inform health care providers about health alerts and to facilitate the 
process of collecting data on reportable diseases. RSVP is designed to overcome existing barriers to reporting suspicious or 
unusual symptoms in patients, and to capture clinician judgment regarding the severity of an illness and the likely category of the 
disease. RSVP fully supports on-line data entry, reducing the paperwork associated with reporting infectious diseases. RSVP 
immediately catalogs all reports in a summary, which is instantaneously available to local public health officials and physicians. 



External collaborating 


System is 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 


operational 


family practice doctors 


$403,000 


$560,000 


Future plans: Development 


of neural networks and 


maps. 







Source: GAO analysis of DOE data. 
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Within HHS, six agencies work on bioterrorism issues. Combined, these 
agencies have a budget of $3.6 billion for bioterrorism in fiscal year 2004. 
HHS's Office of the Assistant Secretary for Public Health and Emergency 
Preparedness will have $42 million in fiscal year 2004 to direct and 
coordinate the implementation of HHS's bioterrorism programs and to 
support the Department of Homeland Security by providing health and 
medical leadership. CDC's bioterrorism budget for fiscal year 2004 will be 
$1.1 billion, $940 million of which will fund CDC's ongoing state and local 
preparedness program, which supports state surveillance and 
epidemiology capacity, laboratory capacity, communication and IT 
infrastructure, education and training, and health information 
dissemination. In addition, CDC has its own office, the Office of Terrorism 
Preparedness and Response, to coordinate efforts. CDC plans to upgrade 
its own system and laboratory capacity and to expand oversight of inter- 
laboratory transfers of dangerous pathogens and toxins, laboratory safety 
inspections, and anthrax research. The Health Resources Services 
Administration also provides grants to hospitals for bioterrorism 
preparedness and response. 

The Agency for Healthcare Research and Quality funded research on the 
use of information systems and decision support systems to enhance 
preparedness for the delivery of medical care in the event of a bioterrorist 
attack. FDA is increasing its food safety responsibilities by improving its 
laboratory preparedness and food monitoring and inspections in 
accordance with the Public Health Security and Bioterrorism 
Preparedness and Response Act of 2002. The National Institutes of Health 
is planning to implement its strategic plan for biodefense research and 
research agenda for CDC Category A, B, and C agents. 

HHS identified 28 information systems and supporting technologies. 
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Department of Health and Human Services 



■ 



Centers for Disease Control and 



Prevention 



■ 



122 Cities Mortality Reporting System 



Type of system: 

Surveillance 



As part of CDC's national influenza surveillance effort, CDC receives weekly mortality reports from 122 cities and metropolitan areas 
in the United States within 2-3 weeks from the date of death. These reports summarize the total number of deaths occurring in 
these cities/areas each week due to pneumonia and influenza. This system provides CDC with preliminary information with which to 
evaluate the impact of influenza on mortality in the United States and the severity of the currently circulating virus strains. The 
advantage of this system is that it provides timely data 2-3 years before finalized mortality data are available from CDC's National 
Center for Health Statistics. Deaths are reported to CDC by place of occurrence, not by residence. This system is part of BioWatch. 



External collaborating 
partner: 122 Cities' 
Registrars 


System is 
operational 


Used primarily by 
epidemiologists 


FY 2002 IT cost: 

$49,070 


Est. FY 2003 IT cost: 

$61,202 


Future plans: Not available. 


Active Bacterial Core Surveillance (ABCs) 


Type of system: 

Surveillance 



As part of CDC's Emerging Infections Program, ABCs determines the incidence and epidemiological characteristics of invasive 
bacterial disease due to pathogens of public health importance, determines the molecular patterns and microbiological 
characteristics of disease-causing elements, and provides an infrastructure for nested special studies to identify risk factors and to 
evaluate prevention policies. ABCs is a population- and laboratory-based surveillance system. 



External collaborating 


System is 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 


operational 


epidemiologists 


$78,641 


$87,372 



Future plans: Measuring the impact of newly licensed vaccines on disease and drug resistance and harnessing molecular 
techniques to characterize bacteria. 



Bioterrorism Event Notification 


Type of system: 




Communications 



The Bioterrorism Event Notification system tracks emergency-related phone calls to CDC's Emergency Preparedness and 
Response Branch, which maintains the 24-by-7 emergency contact numbers for CDC. The system provides a data set that can be 
used to quantify the number and types of incoming requests for emergency assistance. 



External collaborating 


System is 


Used primarily by CDC 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 


operational 


officials 


Not available 


Not available 



Future plans: Not available. 
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Border Infectious Disease Surveillance Project (BIDS) 


Type of system: 




Surveillance 



BIDS helps public health officials to better understand and detect important infectious diseases along the U.S. -Mexico border. The 
system conducts active, sentinel surveillance for syndromes consistent with hepatitis and febrile-rash illness at clinical facilities on 
both sides of the border. As an infectious disease surveillance system combining syndromal surveillance with appropriate laboratory 
diagnostic testing, BIDS can directly enhance bioterrorism surveillance in this key region. 



External 


System is operational 


Used primarily by state 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


collaborating 




and local public health 


$30,000 


$35,000 


partner: Mexico 




epidemiologists at the 






Ministry of Health 




U.S. -Mexico border 







Future plans: Expansion of the number of sites and syndromes and complete development of the next BIDS software version, 
involving Web-based data entry, which will be consistent with the National Notifiable Disease Surveillance System standards. 



CaliciNet 


Type of system: 




Surveillance 



CaliciNet is used to assist public health officials to more quickly identify contaminated food products associated with outbreaks by 
allowing for the linking of epidemiological and laboratory information from specimens that are collected as part of outbreak 
investigations for viral gastroenteritis. While caliciviruses are not on the CDC list of bioterrorism agents, they could be used in an 
attack. 



External 


System is operational 


Used primarily by state 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


collaborating partner: 




public health officials 


$57,783 


$6,586 


None 











Future plans: CaliciNet will be replaced by a larger system, which is still in the process of being named. 









DPDx 




Type of system: 






Supporting technology 



DPDx uses the Internet to strengthen the level of laboratory professionals' expertise in diagnosing foodborne and other parasitic 
diseases. DPDx offers reference and training and diagnostic assistance. Laboratory professionals can transmit images to CDC and 
obtain answers to their inquiries in minutes to hours. This allows them to more efficiently address difficult diagnostic cases in normal 
or outbreak situations and to disseminate information more rapidly. In addition, this method substantially increases the interaction 
between CDC and public health laboratories. 



External 


System is operational 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


collaborating partner: 




pathologists, laboratory 


$7,000 


$7,000 


None 




technicians, and other 
health care workers 







Future plans: Training and continuing education of laboratory professionals; provision to health facilities worldwide of diagnostic 
assistance by CDC staff supported, when needed, by experts from other institutions; diagnostic quizzes to assess the skills of 
laboratory professionals; and informal, early detection of unusually clustered, atypical, or emerging parasitic diseases. Plans also 
include ensuring communication and functionality with all state public health departments. 
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Early Aberration Reporting System (EARS) 


Type of system: 




Communications 



EARS is a SAS-based, Web-enabled reporting tool that allows the analysis of public health surveillance data using aberration 
detection methods. Its goal is to assist public health officials in the early identification of disease outbreaks, as well as bioterrorism 
events. It assesses whether the current number of reported cases of an event is higher than usual. EARS provides results from its 
aberration detection analysis, as well as quick data summaries and graphs. 



External 


System is 


Used primarily by public 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


collaborating partner: 


operational 


health officials 


$88,000 


$240,000 


None 











Future plans: Incorporating bioterrorism detection methods in future versions. Plans also include the implementation of a GIS 
system that will allow for maps of syndromic or disease events and the incorporation of additional methodologies. 



Electronic Foodborne Outbreak Reporting System (EFORS) 


Type of system: 




Surveillance 



EFORS replaces the Foodborne Disease Outbreak Surveillance System. EFORS enables a Web-based application for states to 
report foodborne outbreaks electronically rather than on the former paper-based system. Data are then used for annual summary 
reports and monitoring for multi-state outbreaks. 



External 


System is operational 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


collaborating partner: 




state and county 


$156,157 


$126,949 


None 




public health officials 







Future plans: Improving the database structure to allow immediate viewing of reports as changes occur. EFORS intends to provide 
data for estimates of the burden of foodborne illness by food commodity. 



Epidemic Information Exchange (Epi-X) 


Type of system: 




Communications 



Epi-X connects state and local public health officials so that they can share information about outbreaks and other acute health 
events, including those possibly related to bioterrorism. It is intended to provide epidemiologists and others with a secure, Web- 
based platform that can be used for instant emergency notification of outbreaks and requests for CDC assistance. Epi-X provides 
tools for searching, tracking, discussing, and reporting on diseases. EPI-X is being used in DHS's BioWatch program. 



External collaborating 


System is operational 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




epidemiologists, 
veterinarians, and 
other relevant 
health professionals 


$1,354,828 


$1,382,199 



Future plans: Increasing its user base to ensure rapid, secure communications at all levels of public health, such as linking to 
CDC's Emergency Operations Center and to state and local public health departments. Plans also include linking with comparable 
state level systems, providing secure communication for multistate outbreak response teams, and automating the recognition of 
disease outbreaks across jurisdictions. 
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Federal Facilities Information Management System (FFIMS) 



Type of system: 

Supporting technology 



FFIMS aids in collecting, managing, and analyzing data that originate outside the agency. Its primary use is as an investigative 
system to aid in public health assessments at specific sites. It has been most useful in the collection and analysis of voluminous 
environmental sampling data. FFIMS can be used to investigate an anomaly after it has been identified and to help determine the 
source of health outcomes or the potential risk of adverse health outcomes. 



External collaborating 


System is operational 


Used primarily by CDC 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




epidemiologists 


$1 ,004,986 


$1,129,483 



Future plans: Addition of remote data collection and conversion to a Web-based application. 



Foodborne Disease Active Surveillance Network (FoodNet) 


Type of system: 




Surveillance 



As part of CDC's Emerging Infections Program, FoodNet provides a network for responding to new and emerging foodborne 
diseases of national importance, monitoring the burden of foodborne diseases, and identifying the sources of specific foodborne 
diseases. It consists of active surveillance and a related epidemiological study, which helps public health officials better understand 
the epidemiology of foodborne diseases in the United States. 



External collaborating 


System is operational 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: USDA and 




epidemiologists and 


$475,500 


$515,900 


HHS/FDA 




public health officials 







Future plans: Estimate the burden of foodborne illnesses in the United States, follow trends in the incidence of foodborne infectious 
disease, and attribute foodborne infections to specific food vehicles. 



Geographic Information Systems (GIS) 


Type of system: 




Supporting technology 



GIS tracks the spread of environmental contamination through a community, identifies geographic areas of particular health 
concern, and identifies susceptible populations. Among other things, GIS can be used to help identify spatial clustering of abnormal 
events as the data is collected. This can assist under emergency conditions by identifying affected areas, predicting dispersion of 
the agent, and sharing information with personnel who are responsible for incident management. 



External collaborating 


System is 


Used primarily by CDC 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 


operational 


officials 


$2,105,977 


$2,091,737 



Future plans: Expansion of GIS services (e.g., for field-based use), integration with the Hazardous Substances Emergency Event 
System, and possible integration with CDC's NEDSS. 
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Global Emerging Infections Sentinel Network (GeoSentinel) 




Type of system: 






Surveillance 









GeoSentinel is a Web- and provider-based sentinel network. It consists of travel/tropical medicine clinics around the world 
participating in surveillance to monitor geographic and temporal trends in morbidity among travelers and other globally mobile 
populations. Passive surveillance and response capabilities are also extended to a broader network of GeoSentinel Network 
members. 



External collaborating 


System is operational 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: International 




physicians in travel/ 


$59,282 


$10,000 


Society of Travel 




tropical medicine clinics 






Medicine 











Future plans: Increasing the number and geography of involved clinics, expanding partnerships, and enhancing electronic 
infrastructure to include simultaneous conferencing in real time with all global sites in preparation for global disease outbreaks or 
bioterrorism threats. 



Hazardous Substances Emergency Event System (HSEES) 



Type of system: 

Surveillance 



HSEES collects and analyzes information on events involving hazardous substances as well as threatened releases that result in a 
public health action. Information about the chemical, victims, and event is recorded by state health departments and transmitted to 
CDC in near real time for analysis and dissemination of reports. It can be easily enhanced to collect biological agents in addition to 
chemical agents. 



External collaborating 


System is operational 


Used primarily by state 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




public health officials 


$528,954 


$580,866 



Future plans: Inclusion of additional state health departments and integration with GIS. 



Health Alert Network (HAN) 



Type of system: 

Communications 



HAN is a nationwide system serving as a platform for the distribution of health alerts, dissemination of prevention guidelines and 
other information, distance learning, national disease surveillance, and electronic laboratory reporting, as well as for CDC's 
bioterrorism and related initiatives to strengthen preparedness at the local and state levels. Among other things, HAN is to provide 
early warning alerts and to ensure capacity to securely transmit surveillance, laboratory, and other sensitive data. 



External collaborating 


System is operational 


Used primarily by state 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: Local, state, 




public health officials 


$624,000 


$624,000 


and territorial public 










health agencies 











Future plans: Not available. 
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Influenza Sentinel Provider Surveillance System 



Type of system: 

Surveillance 



The Influenza Sentinel Provider Surveillance System is one of four separate components that allows CDC to, among other things, 
detect changes in influenza and monitor influenza-like illness. It is accessible through the Internet and provides data on the 
circulation and impact of influenza year-round. It also provides information on new influenza strains in circulation that can be used 
to determine the components of the vaccine for the next influenza season and as a pandemic warning. 



External collaborating 
partner: None 


System is 
operational 


Used primarily by CDC 
officials, physicians, state 
public health officials and 
WHO 


FY 2002 IT cost: 

$52,623 


Est. FY 2003 IT cost: 

$54,063 


Future plans: Not available. 


Laboratory Information Tracking System (LITS Plus™) 


Type of system: 

Supporting technology 


LITS Plus™ is a laboratory data management system, which is used to enter, edit, analyze, and report laboratory test results 
electronically. Users can examine all the data about a specimen, including data from all laboratories that performed tests on the 
specimen. It provides seamless integration of laboratory data, including laboratory instrument data and incorporates extensive 
laboratory data management functionality. 


External collaborating 
partner: DOD and 
Global AIDS Program 
(Africa) 


System is operational 


Used primarily by public 
health, CDC, DOD, and 
Global AIDS officials 


FY 2002 IT cost: 

$1,769,098 


Est. FY 2003 IT cost: 

$1,831,522 



Future plans: Develop and implement standardized modules in LITS Plus™ for all CDC Category A bioterrorism labs and to 
comply with CDC's Public Health Information Network. 



Laboratory Response Network (LRN) 



Type of system: 

Communications 



LRN is an integrated network of public health and clinical laboratories that provide laboratory diagnostics and disseminated testing 
capacity for public health preparedness and response. It ensures that all member laboratories collectively maintain state-of-the-art 
biodetection and diagnostic capabilities as well as surge capacity for all biological and chemical agents likely to be used by 
terrorists. LRN is based on the use of standard protocols and reagents, integrated data management, and secure communications. 



External collaborating 


System is operational 


Used primarily by state 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: DOD, FDA, 




and local public health 


$385,000 


$502,500 


FBI, and Association of 




officials 






Public Health Labs 











Future plans: Update and revise laboratory protocols for biological and chemical agents on the LRN Web site; develop new 
screening assays for biological agents and obtain FDA approval for in vitro diagnostic use of new rapid screening assays; link to 
NEDSS; expand domestic partnership; and upgrade restricted Web site for interoperability and data exchange with key clinical 
entities. 



Page 74 



GAO-03-139 Federal Bioterrorism IT 



Appendix VII: Department of Health and 
Human Services' Systems Inventory 




Type of system: 

Surveillance 



The National Botulism Surveillance system compiles information on cases of foodborne and wound botulism. CDC provides clinical, 
epidemiological, and laboratory consultation for suspected botulism cases 24 hours a day and is the only source for antitoxin in the 
United States. Also, CDC conducts a yearly survey of state and territorial epidemiologists and of state public health laboratory 
directors to identify additional cases that have not been previously reported. 



External collaborating 


System is operational 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




clinicians, laboratory 


$2,000 


$2,000 






professionals, and 










epidemiologists 







Future plans: Use electronic near real-time reporting of botulism testing results, which will be integrated with reports of clinical 
consultations and antitoxin releases for suspect cases and for rapid case updates. 



National Electronic Disease Surveillance System (NEDSS) Base System 



Type of system: 

Surveillance 



The NEDSS base system is a component of CDC's overall NEDSS initiative. It will provide a NEDSS architecture-compliant option 
for states to use as a platform for disease surveillance. The NEDSS base system is a CDC-developed system that provides a 
platform upon which many public health surveillance systems, processes, and data can be integrated in a secure environment. It 
will provide the foundation for state and program area needs, data collection, and processing, including the development of modules 
that can be used for data entry and for management of core demographic and notifiable disease data via a Web browser. The first 
release supports the electronic processes involved in notifiable disease surveillance and analysis, replacing the functionality 
currently supported by the NETSS system. States also have the option to develop systems or elements on their own through the 
use of grants provided for this purpose rather than using the NEDSS base system. 



External collaborating 
partner: State, local, and 
territorial public health 
agencies, and various 
public health-related 
professional associations 3 



System is currently 
being piloted 



Used primarily by state 
and local public health 
officials and CDC officials 



FY 2002 IT cost: 

Not available 



Est. FY 2003 IT cost: 

$27,609,000 



Future plans: Additional functionality to support other programs, such as chronic disease and environmental health programs, for 
use by epidemiologists, laboratory personnel, and data managers from various program areas. 



a Professional associations' involvement includes the Association of State and Territorial 
Health Officials (ASTHO), the Association of Public Health Laboratories (APHL), the 
Council of State and Territorial Epidemiologists (CSTE), the National Association of Health 
Data Organizations (NAHDO), the National Association of County and City Health Officials 
(NACCHO), and the National Association for Public Health Statistics and Information 
Systems (NAPHSIS). 
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National Electronic Telecommunications Systems for Surveillance 



Type of system: 

Surveillance 



NETSS provides weekly data regarding cases of nationally notifiable diseases. It serves a supportive role for bioterrorism-related 
surveillance allowing the transmission of limited epidemiological information describing cases of infectious disease that may or may 
not be related to bioterrorism. As needed, local and state health departments can use well-established, routine NETSS information 
exchange protocols to augment more focused or specific bioterrorism surveillance data exchange. 



External collaborating 
partner: State, local, 
and territorial public 
health agencies, and 
various public health- 
related professional 
associations 3 


System is operational 


Used primarily by state 
public health officials, 
CDC officials, and 
health care providers 


FY 2002 IT cost: 

$586,301 

(includes the cost for the 
National Notifiable 
Disease Surveillance 
System) 


Est. FY 2003 IT cost: 

$620,929 

(includes the estimated 
cost for the National 
Notifiable Disease 
Surveillance System) 


Future plans: NETSS will be phased out as NEDSS is deployed and implemented. 


National Molecular Subtyping Network for Foodborne Disease Surveillance 


Type of system: 

Supporting technology 


PulseNet is an early warning system for outbreaks of foodborne diseases. It is a national network of public health laboratories that 
perform DNA "fingerprinting" on foodborne bacteria. It permits rapid comparisons of these fingerprint patterns through an electronic 
database and provides critical data for the early recognition and timely investigation of outbreaks. 


External collaborating 
partner: USDA/FSIS, 
HHS/FDA, Health 
Canada 


System is operational 


Used primarily by 
public health officials 
and food regulatory 
agency officials 


FY 2002 IT cost: 

$221,400 


Est. FY 2003 IT cost: 

$235,000 



Future plans: Expansion to include additional pathogens (including those that may be used by bioterrorists) and to facilitate the 
establishment of compatible networks in Europe, the Pacific Rim region, and Latin America. 




Type of system: 

Surveillance/Communications 



NREVSS is a laboratory-based system that monitors temporal and geographic patterns associated with the detection of respiratory 
syncytial viruses (RSV), human parainfluenza viruses (HPIV), respiratory and enteric adenoviruses, and rotaviruses. Influenza 
specimen information, also reported to NREVSS, is integrated with CDC influenza surveillance. While these agents are not on the 
CDC list, they could be potentially used for bioterrorism. NREVSS is a Web-based and telephone dial-in system. 



External collaborating 


System is operational 


Used primarily by state 


FY 2002 IT cost: 


Est. FY 2003 IT 


partner: None 




public health officials and 


$61 ,835 


cost: 






professionals 




$2,685 



Future plans: Replace the telephone dial-in functionality to be Web-based once all users have access capabilities. 
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Plague 


Type of system: 




Surveillance 



The plague surveillance system is comprised of clinical, epidemiological, and ecologic information on presumptive and confirmed 
cases reported by state public health departments. Basic descriptive statistical analyses are performed on these data, such as 
regional- and county-specific incidence rates. Plague is also one of three internationally quarantinable diseases, and, according to 
the International Health Regulations, all cases must be investigated and reported to the World Health Organization in Geneva. 



External collaborating 


System is operational 


Used primarily by state 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




and local public health 


$2,350 


$2,350 






officials and Indian 










Health Services' 










officials 







Future plans: Integrate with CDC's bioterrorism preparedness programs. 



Public Health Laboratory Information System (PHLIS) 


Type of system: 




Surveillance 



PHLIS is designed for use in public health laboratories for the reporting and analysis of a variety of conditions of public health 
importance, which have a significant laboratory-testing component, e.g., salmonella. PHLIS reports standard demographic data that 
are associated with a laboratory isolate as well as laboratory test results, information about laboratory procedures, and outbreak- 
related information. 



External collaborating 
partner: None 


System is operational 


Used primarily by state 
public health officials 


FY 2002 IT cost: 

$149,091 


Est. FY 2003 IT cost: 

$154,160 


Future plans: Not available. 


Statistical Outbreak Detection Algorithm (SODA) 


Type of system: 

Surveillance 



SODA processes pathogen information (i.e., salmonella, shigella, and e. coli) on a daily basis to detect anomalies or unusual 
clusters in the reported versus expected counts at the state, regional, and national levels. Its main goal is to provide users with an 
interface to view reports, generate graphs and produce maps from the state, regional, and national perspectives. SODA utilizes a 
cumulative sums algorithm commonly used in the manufacturing industry. The output is a statistical measure that is flagged for 
review by CDC's foodborne staff. SODA uses general information from lab specimen data, such as date and location. 



External collaborating 


System is operational 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




epidemiologists 


$112,350 


$116,169 



Future plans: Addition of other pathogens for monitoring. 
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Unexplained Deaths and Critical Illnesses Surveillance System 


Type of system: 




Surveillance 



As part of CDC's Emerging Infections Program, the Unexplained Deaths and Critical Illnesses Surveillance System is expected 
to contain limited epidemiological and clinical information on previously healthy persons aged 1 to 49 years who have illnesses 
with possible infectious causes. It is also expected to provide active population-based surveillance through coroners and 
medical examiners at limited sites. National and international surveillance will be passive for clusters of unexplained deaths and 
illnesses. 



External collaborating 


System is in 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 


development 


epidemiologists 


$28,980 


$37,290 



Future plans: Further development of an integrated data management system for clinical, epidemiological, specimen tracking, 
and test results data, including novel diagnostics and pathogen discovery. 




eLEXNET provides a Web-based system for real-time sharing of food safety laboratory data among federal, state, and local 
agencies. It is seamless and secure, allowing public health officials at multiple government agencies engaged in food safety 
activities to compare and coordinate laboratory analysis findings. It captures food safety sample and test result data from 
participating laboratories and uses them for risk assessment and decision-support purposes, improving early detection of 
problem products and enabling active food safety surveillance and evaluation of potential threats to the American food supply. 



External collaborating 


System is operational 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: USDA; DOD 




public health and 
agricultural food safety 
officials 


$5,096,000 


$3,750,000 



Future plans: Expanding participating food safety laboratory partnerships and developing an integrated short- and long-term 
strategic plan and communications planning approach. 



Source: GAO analysis of HHS data. 
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VA manages one of the nation's largest health care systems and is the 
nation's largest drug purchaser. The department purchases 
pharmaceuticals and medical supplies for the Strategic National Stockpile 
Program and the National Medical Response Team stockpiles. 

VA identified one information system. 



Department of Veterans Affairs 


Emerging Pathogens Initiative (EPI) 


Type of system: 

Surveillance 



EPI identifies antibiotic-resistant and otherwise problematic pathogens within the Veterans Health Administration facilities. This 
information is used to help formulate plans on a national level for intervention strategies and resource needs. Results of aggregate 
data may also be shared with appropriate public health authorities for planning on the national level for the non-VA and private health 
care sectors. EPI provides general surveillance on specific pathogens and diseases. 



External collaborating 


System is 


Used primarily by VA 


FY 2002 IT cost: 


Est FY 2003 IT Cost 


partner: None 


operational 


medical staff 


Not available 


Not available 



Future plans: Addition of new diseases or organisms as they are identified. 



Source: GAO analysis of VA data. 
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EPA has responsibilities to prepare for and respond to emergencies, 
including those related to biological materials. EPA can be involved in 
detection of agents by environmental monitoring and sampling. EPA is 
responsible for protecting the nation's water supply from terrorist attack 
and for prevention and control of indoor air pollution. EPAs National 
Homeland Security Research Center is in the process of preparing an on- 
line virtual library of homeland security-related documents and tools 
intended to assist decision making during emergency situations. Data in 
the library will include exposure guidelines, databases, publications, and 
Web sites applicable to biological, chemical, and radiological threats. 



EPA identified five supporting technologies. 



Environmental Protection Agency 




Type of system: 

Supporting technology 



IAQX is an indoor air quality simulation package that consists of a general-purpose simulation program and a series of stand-alone, 
special purpose programs. Relatively simple mass transfer models are provided by the general-purpose simulation program, and 
more complex models are implemented by the stand-alone, special purpose simulation programs. In addition to performing 
conventional indoor air quality simulations, which calculate the pollutant concentration and personal exposure as a function of time, 
IAQX can estimate the adequate ventilation rate when certain air quality criteria need to be satisfied. This feature is useful for product 
stewardship and risk management. 



External collaborating 


System is operational 


Used primarily by 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




advanced users — EPA 


Not available 


Not available 




officials and the public 







Future plans: Addition of more special purpose programs, such as models for indoor air chemistry and indoor application of 
pesticides. 
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Type of system: 

Supporting technology 



EPANET was developed to help water utilities maintain and improve the quality of water delivered to consumers through their 
distribution systems. It is a computer modeling software package that can be used to simulate drinking water distribution systems and 
to simulate water flow patterns in those systems. The model is also used to simulate contaminant dispersion patterns if chemical or 
biological contaminants are introduced into a water system. It can be used to inform water utilities where critical points (valves, 
pumps, etc.) are located in the system and what the impact of the system would be if those points were attacked. 



External collaborating 


System is operational 


Used by EPA officials 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




and the public 


Not available 


Not available 



Future plans: Not available. 









Type of system: 




Supporting technology 



RISK is an indoor air quality model developed by the Indoor Environment Management Branch of EPA's National Risk Management 
Research Laboratory. It was developed as a tool to carry out the mission of the engineering portion of the EPA's indoor air research 
program to provide tools necessary to reduce individual exposure to and risk from indoor air pollutants. RISK uses the concepts of 
buildings and scenarios, including fixed information about a building (the number of rooms, the room dimensions, and the 
arrangement of the rooms) and changing information sources (sinks, air exchange, room-to-room flows, etc.). The model provides 
risk, exposure, and concentration information. RISK allows analysis of the impact of multiple pollutants on the indoor environment. 



External collaborating 


System is operational 


Used primarily by EPA 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




officials and the general 


Not available 


Not Available 






public 







Future plans: Addition of more risk calculations and of models and suggested values for indoor particulate. 



Safe Drinking Water Accession and Review System (SDWARS) 


Type of system: 




Supporting technology 



SDWARS tracks monitoring results for specific lists of unregulated chemical contaminants to indicate occurrences in public drinking 
water systems. Public water systems submit Unregulated Contaminant Monitoring Rule (UMCR) data elements through SDWARS for 
inclusion in the National Drinking Water Contaminant Occurrence Database. SDWARS is a one-entry approach to the electronic 
reporting process to improve reporting quality, reduce reporting errors, and reduce the time involved in investigating and correcting 
errors at all levels (e.g., laboratories, states, and EPA). 



External collaborating 


System is operational 


Used primarily by EPA 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




officials and the general 


$350,000 


$300,000 






public 







Future plans: Accommodate additional contaminants, including microbial contaminants. 
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Type of system: 




Supporting technology 



SDWIS/FED is a database designed and implemented by EPA to meet its needs in the oversight and management of the Safe 
Drinking Water Act. It contains public water system inventory information and summary violation data submitted by states and EPA 
regions in conformance with reporting requirements established by statute, regulation, and guidance. 



External collaborating 


System is operational 


Used primarily by EPA 


FY 2002 IT cost: 


Est. FY 2003 IT cost: 


partner: None 




officials 


$2,100,000 


$1,700,000 



Future plans: Replace with a new drinking water data warehouse. 



Source: GAO analysis of EPA data. 
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In addition to the agencies' individual systems that they identified, there 
are several other IT initiatives in process or being planned to better 
support agencies' abilities to prepare for, respond to, and communicate 
during public health emergency events. These projects are intended to 
provide integration and interoperability among systems, improve 
communications, and better support the public health infrastructure. 



Information technology initiatives 


Lead agency 


Collaborating agencies 


Status of 
development 


Public Health Information Network 
(PHIN) 


HHS/CDC 


State, territorial, and local public health 
agencies and various public health- 
related professional associations 3 


Planning 



The PHIN is an effort initiated by the CDC to provide interoperability across public health functions and organizations, such as state 
and federal agencies, local health departments, public health labs, vaccine clinics, clinical care, and first responders. It is intended 
to, among other things, (1) deliver industry standard data to public health, (2) investigate bioterrorism detection, (3) provide disease 
tracking analysis and response, and (4) support local, state, and national data needs. It builds on existing CDC investments from 
HAN, NEDSS, EPI-X, LRN, and the CDC Web. The PHIN will not replace any of these systems but will provide an "umbrella" to 
support the interoperability of existing CDC surveillance, communications, and reporting systems. 



National Electronic Disease 
Surveillance System (NEDSS) 
Architecture 



HHS/CDC 



State, territorial, and local public health 
agencies and various public health- 
related professional associations 8 



Development 



In fiscal year 2001 , CDC implemented the NEDSS architecture project to replace or enhance the interoperability of its numerous 
existing surveillance systems. NEDSS promotes the use of data and information standards to advance the development of efficient, 
integrated, and interoperable surveillance systems at the federal, state, and local levels. When completed, NEDSS will electronically 
integrate a wide variety of surveillance activities and will facilitate more accurate and timely reporting of disease information to CDC 
and state and local health departments. NEDSS is also designed to reduce provider burden in the provision of information and 
enhance both the timeliness and quality of information provided. The NEDSS architecture will include (1) data standards, (2) an 
Internet-based communications infrastructure built on industry standards, and (3) policy-level agreements on data access, sharing, 
burden reduction, and protection of confidentiality. 



a Professional associations' involvement includes the Association of State and Territorial 
Health Officials (ASTHO), the Association of Public Health Laboratories (APHL), the 
Council of State and Territorial Epidemiologists (CSTE), the National Association of Health 
Data Organizations (NAHDO), the National Association of County and City Health Officials 
(NACCHO), and the National Association for Public Health Statistics and Information 
Systems (NAPHSIS). 
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Information technology initiatives 


Lead agency 


Collaborating agencies 


Status of 








development 


National Environmental Public Health 
Tracking Network (NEPHTN) 


HHS/CDC 


EPA 


Planning 



The NEPHTN is a collaborative effort between CDC and EPA to develop a national environmental tracking network that will (1) be 
standards-based; (2) allow direct electronic data reporting and linkage within and across health effect, exposure, and hazard data; 
and (3) be interoperable with other public health systems. Environmental public health tracking is the ongoing collection, integration, 
analysis, and interpretation of data about: environmental hazards, exposure to environmental hazards, and health effects potentially 
related to exposure to environmental hazards. The goal of environmental public health tracking is to protect communities by 
providing information to federal, state, and local agencies. These agencies then use this information to plan, apply, and evaluate 
public health actions to prevent and control environmentally related diseases. Currently, no systems exist at the state or national 
levels to track many of the exposures and health effects that may be related to environmental hazards. 



FSIS Automated Corporate 


USDA/FSIS 


None 


Planning 


Technology Suite (FACTS) 









The FACTS initiative establishes an agencywide, integrated information management and data-sharing resource. It is intended to 
replace existing stovepipe application systems with a suite of components that can interact with each other and share data. FACTS 
is a technology suite composed of a centralized database that will (1) unite several smaller databases and projects that are 
interrelated and (2) provide a central point of access that will decrease data redundancy and inaccuracy. FACTS' main purpose is 
to support the FSIS mission by substantially improving the ability to provide information that is accurate, complete, and timely for 
use by agency decision makers. Although this initiative will not consolidate all food safety information systems into one system, it 
will allow interoperability between systems in USDA agencies and at the U.S. Customs Service. In addition, FSIS and APHIS will 
take major steps toward establishing an integrated data-sharing effort that will specifically define the roles of each agency and will 
better safeguard the United States against foreign animal diseases and food safety hazards. 



Biological Defense Initiative (BDI) 



DOD/DTRA 



DOE 



Cancelled 



DTRA was executing the BDI program to determine the value of integrating systems with each other. This program was intended to 
deliver a national model for biological incidents detection capabilities and to integrate and synthesize information from exiting 
detectors and surveillance systems, such as BASIS, Portal Shield, RSVP, ESSENSE, and B-Safer. The intended partners in the 
BDI were to be CDC, Veterans Health Administration, NIH, USDA, and Interior's Fish and Wildlife Service. However, the scope of 
the project was drastically narrowed as a result of funding reductions — from $215 million dollars to $29 million dollars. BDI has 
recently been cancelled. 



Epidemic Outbreak Surveillance 


DOD/Air Force 


Navy, Army, DTRA, and civilian and 


Development 




academic partners 





EOS is a DTRA-supported initiative that leverages and tests existing and emerging biodefense technologies within a real-world 
testbed. The objectives of the EOS project are to (1) develop a scalable biodefense system for early threat warning, rapid threat 
identification, focused disease treatment, and outbreak containment and (2) enable the use of emerging technologies for testing, 
verification, and validation in a real-world, testbed environment. EOS is currently used to identify epidemics of infectious respiratory 
disease among USAF basic military trainees. It is the first diagnostic platform using DNA-based microarray technologies to be 
tested, verified, and validated. 
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Information technology initiatives 


Lead agency 


Collaborating agencies 


Status of 








development 


Bio-ALIRT 


DOD/DARPA 


Walter Reed Army Institute for 


Development 






Research, academic and commercial 








partners 





Bio-ALIRT is being developed by DARPA to scientifically determine the value of nontraditional data sources, such as human 
behavior, to enable the detection of a biological outbreak from artificial or natural causes up to two days earlier than with traditional 
means. The Bio-ALIRT program will continue to monitor nontraditional data sources, such as animal sentinels, behavioral indicators, 
and prediagnostic medical data, to determine which could effectively serve as early indicators of a biological pathogen release. Data 
sources and algorithms will be evaluated in testbeds. The knowledge and technology developed from the testbeds would be suitable 
for use in any syndromic surveillance system. Future plans for Bio-ALIRT include development of new techniques, such as 
advanced data fusion, detection, and privacy protection algorithms, to differentiate between naturally occurring and deliberate bio- 
releases. 



Program for Response Options and 


DOE/SNL 


None 


Development 


Technology Enhancements for 








Chemical/Biological Terrorism 









PROTECT's objective is to protect people in public facilities, such as subways and airports, from chemical attacks. It is intended to 
addresses vulnerabilities of civilians that were highlighted in the 1995 chemical agent attack in the Tokyo subway system. PROTECT 
rapidly detects the presence of a chemical agent and transmit readings to an emergency management information system. It 
demonstrates the use of integrated systems for the defense of infrastructure facilities. PROTECT does not currently have a bioagent 
use; however, it can provide a near-term solution for 24-by-7 facility monitoring for airborne biological agent releases. PROTECT is a 
DOE Domestic Demonstration and Application Program (i.e., a prototype system to address specific problems in order improve 
infrastructure facility protection). The program takes advantage of recent advances in technology to prepare for and respond to 
attacks in subways, airports, and office buildings where people are concentrated. PROTECT is jointly funded by DOE and the 
Department of Justice. 



National Food Safety Laboratory 


USDA/FSIS and 


USDA/APHIS, DOD/Army, selected 


Development 


HHS/FDA 


state food laboratories 





The NFSLS is a newly initiated project to integrate systems for sharing information. It is currently a pilot program involving federal 
food laboratories at FSIS, FDA, the Army, and state food laboratories in Tennessee, Florida, New Hampshire, Massachusetts, and 
municipal food laboratories in Milwaukee, Wisconsin, and Cincinnati, Ohio. The program will also focus on the assurance of rapid 
sharing of reliable data through FDA's e-LEXNET system. USDA and HHS will collaborate with federal, state, and local agencies to: 
(1) provide a national seamless data exchange system for food laboratory information; (2) provide an infrastructure that is portable, 
intuitive, and ready to exchange data from state, local, and federal databases and varying internal network designs; (3) enhance 
communication and collaboration among food safety partnerships; (4) provide the ability to detect, compare, and communicate 
current findings in food laboratory analysis; and (5) demonstrate that multiple agencies engaged in food safety regulatory activities 
could leverage the resources necessary to achieve the common goal of reducing the incidence of microbial foodborne illness. 
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Information technology initiatives 


Lead agency 


Collaborating agencies 


Status of 








development 


National Infrastructure Project 


HHS/CDC 


None 


Development 



The purpose of the National Infrastructure Project is to strengthen CDC's infrastructure and network management in order to help 
ensure continuity of operations for the NCEH during emergencies. Its objectives are to achieve zero latency on all network 
operations and to provide redundancy and higher network uptime. The center is implementing cluster technology to help achieve 
redundancy without latency, thus increasing the reliability of the network. Storage area networks are being used to provide logical 
and physical disk drives with connected servers. Other commercial tools are used to monitor the network and detect problems before 
they occur. NCEH is also purchasing UPS paging to allow early detection of problems within the facility. For example, pagers will 
go off whenever water sensors or smoke detectors are activated. NCEH has a triage plan, which includes the use of E-mails, 
pagers, and phone calls combined with paging systems. 



Forensics Internet Research 


DOE/LAN L 


None 


Development 


FIRE is an initiative to develop an internet-based research exchange system for laboratories and government agencies. It is 
intended to allow the sharing of biothreat information over a secure VPN. It is anticipated that the system will be able to tie identified 
bioagent strains to particular organizations based upon previous identification of strains and their origins. 


Molecular Recognition-based Real 
Time Detection 


DOE/LAN L 


None 


Planning 



The Molecular Recognition-based Real Time Detection initiative is intended to develop new sensors for biological and chemical 
warfare agents. The work may provide more specific and sensitive sensors, having very low or no false positives that can be used to 
collect samples and provide data to information systems. Future plans include the development of single receptors for multiple 
bioagents or for a combination of biological and chemical agents. 



Source: GAO analysis of agency data. 
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Appendix XI: List of Selected Health Care 
Standards 



Several organizations have defined standards for health care data and 
communications. Several important standards development initiatives and 
the vocabulary and messaging standards that they have defined are 
described below: 



Standard 

Health Level Seven (HL7) 



Logical Observations Identifiers Names 
and Codes (LOINC) 



Systemized Nomenclature of Medicine 
(SNOMED) 



Unified Medical Language System 
(UMLS) 



Common Information for Public Health 
Electronic Reporting (CIPHER) 



Description 

HL7 is an ANSI-accredited standards development organization that creates message 
format standards. Version 2.3 provides a protocol that enables the flow of data between 
systems. Version 3.0 is being developed through the use of a formalized methodology 
involving the creation of a Reference Information Model to encompass the ability, not 
only to move data, but to use data once it is moved. 

LOINC is a set of code standards that identifies clinical questions, variables, and reports. 
It comprises a database of 15,000 variables with synonyms and cross-mappings; it 
covers a wide range of laboratory and clinical subject areas. The formal structure has six 
parts: component, property measured, time aspect, system, precision, and method. 

SNOMED is a nomenclature classification for indexing medical vocabulary, including 
signs, symptoms, diagnoses, and procedures; it defines code standards in a variety of 
clinical areas called coding axes. It can identify procedures and possible answers to 
clinical questions that are coded through LOINC. 

The National Library of Medicine developed UMLS as a standard health vocabulary that 
enables cross-referencing to other terminology and classification systems and includes a 
metathesaurus, a semantic network, and an information sources map. Its purpose is to 
help health professionals and researchers retrieve and integrate electronic biomedical 
information from a variety of sources, irrespective of the variations in the way similar 
concepts are expressed in different sources and classification systems. 

CIPHER'S objective is to establish standards for the data used in surveillance, to allow 
for a consistent definition and a consistent implementation across programs. The 
following objectives have been defined for CIPHER: (1) establish consistent definitions 
for information collected and used by surveillance systems; (2) define standards for how 
questions are to be formatted and information is to be collected on surveillance case 
report forms; (3) identify standards for the processing of data in electronic data entry 
systems, including value/label displays, reference table look-ups, and a minimum level of 
edit-checking; (4) identify storage standards; (5) provide guidance on electronic data 
interchange; and (6) provide guidance on coding for the display of data in statistical 
analyses and reports. 



Source: GAO. 
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Appendix XII: Comments from the 
Department of Defense 




ASSISTANT TO THE SECRETARY OF DEFENSE 

3050 DEFENSE PENTAGON 
WASHINGTON, DC 20301-3050 



NUCLEAR AND CHEMICAL 
AND BIOLOGICAL DEFENSE 
PROGRAMS 



MAY 1 9 2003 



Mr. David A. Powner 
Director (Acting) 

Information Technology Management Issues 
U.S. General Accounting Office 
Washington, D.C. 20548 

Dear Mr. Powner: 



This is the Department of Defense (DoD) response to the General Accounting Office 
(GAO) draft report, GAO-03-139, "BIOTERRORISM: Information Technology Strategy Could 
Strengthen Federal Agencies' Ability to Respond to Public Health Emergencies," dated April 21, 
2003, (GAO Code 310432). 

The DoD provides the enclosed comments for accuracy and clarification. 

We appreciate the opportunity to review and respond to the subject draft audit report. 
Should you have any questions regarding this response, please contact COL Steve Lawrence at 
(703)697-1797. 

Sincerely, 

^y5e,-«) % — - 

Anna Johnson-Wineger, Ph.D. 

Deputy for Chemical/Biological Defense 

Enclosure: 
As stated 
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Department of Energy 




Department of Energy 

National Nuclear Security Administration 

Washington, DC 20585 

May 13, 2003 



Mr. David A. Powner 
Acting Director 
Information Technology Issues 
U. S. General Accounting Office 
Washington, D C. 20548 

Dear. Mr. Powner: 

The National Nuclear Security Administration (NNSA) has reviewed the draft 
report, Bioterrorism: Information Technology Strategy Could Strengthen Federal 
Agencies 'Ability to Respond to Public Health Emergencies (GAO-03-139). 
While there are no recommendations to the Department of Energy or the NNSA 
we offer the following comments: 

Simply inventorying the IT systems without a more detailed description of 
their capabilities could obscure some of the gaps or needs in the overall 
infrastructure. With more information, it is possible for agencies to focus 
scarce resources into those areas of greatest need. 
We believe that the Autonomous Pathogen Detection System (APDS), 
developed by the Lawrence Livermore National Laboratory, should be 
added to the inventory either in Appendix VI or Appendix X 
Additionally, if it is germane to the report, NNSA and the Department as a 
whole, have BioWatch and BioShield involvement. 

NNSA on behalf of the Department of Energy, appreciates GAO's efforts and our 
opportunity to have reviewed this draft report. 

Sincerely, 

^4^^ 

Michael C. Kane 

Acting Associate Administrator 

for Management and Administration 



Printed with soy ink on recycled paper 
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Appendix XIV: Comments from the 
Department of Health and Human Services 



Note: GAO comments 
supplementing those in 
the report text appear at 
the end of this appendix. 




DEPARTMENT OF HEALTH & HUMAN SERVICES 



Office of Inspector General 



Washington, D.C. 20201 



MAY I 5 2003 



Mr. David A. Powner 

Director (Acting), Information Technology 

Management Issues 
United States General 

Accounting Office 
Washington, D.C. 20548 

Dear Mr. Powner: 

Enclosed are the department's comments on your draft report entitled, "Bioterrorism: 
Information Technology Strategy Could Strengthen Federal Agencies' Abilities to Respond to 
Public Health Emergencies." The comments represent the tentative position of the department 
and are subject to reevaluation when the final version of this report is received. 

The department provided several technical comments directly to your staff. 

The department appreciates the opportunity to comment on this draft report before its 
publication. 



The Office of Inspector General (OIG) is transmitting the department's response to this draft 
report in our capacity as the department's designated focal point and coordinator for General 
Accounting Office reports. The OIG has not conducted an independent assessment of these 
comments and therefore expresses no opinion on them. 



Sincerely, 




Dennis J. Dwjuette^ 
Acting Principal Deputy Inspector General 



Enclosure 
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Department of Health and Human Services 



Comments of the Department of Health and Human Services on the General 
Accountine Office's Draft Report, "Bioterrorism: Information Technology Strategy 
Could Strengthen Federal Agencies' Abilities to Respond to Public Health 
Emergencies" (GAO-03-139) 

The Department of Health and Human Services (department) appreciates the opportunity 
to comment on the Genera] Accounting Office's (GAO) draft report and strongly agrees 
that the use of emerging information technology (IT) to support the public health 
infrastructure could help to improve federal agencies' abilities to prepare for and respond 
to public health emergencies. 



GAO Recommendation for Executive Action 



The GAO recommends that the Secretary of Health and Human Services, in coordination 
with the Secretary of Homeland Security, establish a national IT strategy for public health 
preparedness and response. This IT strategy should identify steps towards improving the 
nation's ability to use IT in support of the public health infrastructure. More specifically, 
it should: 



• Identify all federal agencies' IT initiatives, using the results of our inventory 
as a starting point; 

• Set priorities for information systems, supporting technologies, and other IT 
initiatives; 

• Define activities for ensuring that the various standards-setting organizations 
coordinate their efforts and reach consensus on the definition and use of 
standards; 

• Establish milestones for defining and implementing standards; 

• Create a mechanism to monitor the implementation of standards throughout 
the health care industry; and 

• Address existing barriers and establish mechanisms for identifying and 
prioritizing uses of emerging technologies that are appropriate for ensuring 
continued improvements to the nation's ability to prepare for and respond to 
public health emergencies. 



Department Response 



See comment 1 . 



The department agrees that improvements in public health emergency preparedness and 
response capability, including bioterrorism related threats, will require progress on health 
information technology and standards and the National Health Information Infrastructure 
broadly. We offer the following general comments: 

1 . In general, the report would benefit from a clearer distinction between federal 
agency responsibilities, activities and authorities and those of the private health 
care sector and the public health system. The draft report and its 
recommendations tend to blur these activities as well as minimize the scope and 
complexity of the situation. Surveillance and public health in the United States 
are primarily state functions. Good progress is being made toward ensuring that 



1 
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See comment 2. 



See comment 3. 



See comment 4. 



See comment 5. 



See comment 6. 



surveillance systems are compatible among the Centers for Disease Control and 
Prevention (CDC), local and state health departments in addition to health care 
providers. As a result of the Consolidated Health Informatics (CHI) initiative and 
several prior initiatives, agencies in the federal health care enterprise have agreed 
on national consensus health data standards to promote interoperability within the 
federal health care enterprise. Adoption of interoperability standards among 
federal health agencies is a major step forward and is expected to be an industry 
"tipping point." However, the widespread adoption of those standards in the 
private sector health care and the public health system generally tends to be a 
much more complex and difficult goal, because the federal government has little 
influence in most areas. 

While we agree that more coordination across federal agencies would be helpful, 
the report does not adequately recognize the level of interagency coordination and 
success that is already underway, particularly regarding the CHI initiative and the 
adoption of health data interoperability standards. Instead of describing the CHI 
initiative as a promising model for coordination that has been successful, the 
report tends to minimize the CHI effort and contribution in both interagency 
coordination and major progress on health data interoperability standards. For 
example, the CDC's National Electronic Disease Surveillance System (NEDSS) 
and the CDC and Health Resources and Services Administration (HRSA) 
cooperative agreements described above all include CHI data standards. 

Coordinated by the Office of the Assistant Secretary for Public Health Emergency 
Preparedness, the FY 2003 CDC and HRSA cooperative agreements for public 
health and hospital preparedness for bioterrorism both place emphasis on 
information technology (IT) interoperability and laboratory data standards, and 
both incorporate the same health information technology guidance to the states. 

Emphasizing the importance of standards for data, for security, and for electronic 
transport has been a main theme of the CDC NEDSS activities and, more 
recently, for the broader Public Health Information Network (PHIN). The report, 
however, does not appear to recognize CDC's plans for PHIN. 

However, what the report categorizes as IT systems includes core activities of 
CDC's National Center for Infectious Disease (NCTD) programs, of which IT is a 
part, but not the essence. The CDC made an effort to communicate this 
distinction to the team doing this investigation, but does not believe it is reflected 
in the report. For example, FoodNet is included in the analysis. A CDC-state 
collaborative scientific activity, FoodNet conducts surveillance for food borne 
diseases. It involves CDC program personnel and personnel infrastructure in 10 
states. The IT is needed to exchange the data and this effort will be enhanced as 
implementation of NEDSS/PHIN evolves. The IT is needed to help support the 
FoodNet effort, but FoodNet is not an IT system. There are other examples. 
Failing to understand this distinction could lead to an overemphasis of the role of 



2 
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IT in public health surveillance, create unreasonable expectations for IT 
improvements, and result in potentially simplistic suggestions and solutions. 



3 
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The following are GAO's comments on the Department of Health and Human 
Service's letter dated May 15, 2003. 

1. In the background section of the report, we discuss the state and local 
government roles in dealing with public health emergencies, using a graphic to 
further illustrate the different roles. In this section, we have attempted to make a 
clear distinction between federal responsibilities and the responsibilities of other 
entities involved in responding to the release of a biological agent. 

2. As we stated in our report, the Consolidated Health Informatics Initiative is an 
interagency work group lead by HHS, which recently announced the first set of 
standards. While we are encouraged by the interagency coordination involved in 
this initiative, additional work is still needed — in defining activities for ensuring 
further coordination and consensus on the adoption and use of additional 
standards, in establishing milestones for defining and implementing all standards, 
and in creating a mechanism to monitor the implementation of these standards 
throughout the health care industry. We recognize that the adoption of standards 
is an issue for the entire health care industry. 

3. In response to these comments, we have added information on HHS's cooperative 
agreements with states and local governments to the background section of the 
report. 

4. We have included information we received about PHIN in appendix X. 

5. We agree with HHS that IT is one of several components that support the core 
activities of public health surveillance; we discussed this in the Agency Comments 
and Our Evaluation section of the report. 

6. While FoodNet may be a collaborative scientific activity for surveillance of 
foodborne diseases, it also includes an IT component for data exchange, which 
was reported to us by CDC officials. 
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Department of Veterans Affairs 




THE SECRETARY OF VETERANS AFFAIRS 
WASHINGTON 

May 12, 2003 



Mr. David A. Powner 
Director (Acting) 
Information Technology Issues 
U.S. General Accounting Office 
441 G Street, NW 
Washington, DC 20548 

Dear Mr. Powner: 

The Department of Veterans Affairs (VA) has reviewed your draft report, 
BIOTERRORISM: Information Technology Strategy Could Strengthen 
Federal Agencies' Abilities to Respond to Public Health Emergencies (GAO 
03-139). VA agrees with your overall assessment that information technology 
can more effectively facilitate emergency response if standards are developed 
and implemented that allow systems to be interoperable. 

VA continues to partner actively with other Federal agencies, particularly 
the Department of Defense (DoD) and the Centers for Disease Control and 
Prevention (CDC), in information technology homeland security efforts. In 
conjunction with those two lead agencies, VA is developing the capability to 
provide a computerized data stream that will be transmitted daily to DoD and the 
CDC for contemporaneous analysis. Although the primary emphasis of the data 
supply will be ICD-9-CM coding information, other demographic and patient 
location data will be provided, as well. The data stream, which does not include 
interpretable unique identifiers, will be collected and analyzed by the CDC 
through its BioSense program, and by the DoD through its ESSENCE program. 
These data could also be paired with other data streams from other sources to 
identify patterns in syndromes and illnesses that may not originate from natural 
occurrences. VA outpatient and emergency room visits will provide the source 
data. An operational completion date for the venture has not yet been projected. 

Thank you for the opportunity to comment on your draft report. 



Sincerely yours, 
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QAO'S ]\/Jission ^ e General Accounting Office, the audit, evaluation and investigative arm of 

Congress, exists to support Congress in meeting its constitutional responsibilities 
and to help improve the performance and accountability of the federal 
government for the American people. GAO examines the use of public funds; 
evaluates federal programs and policies; and provides analyses, 
recommendations, and other assistance to help Congress make informed 
oversight, policy, and funding decisions. GAO's commitment to good government 
is reflected in its core values of accountability, integrity, and reliability. 
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